@biffo/cli 0.34.1 → 0.35.0

package/dist/index.js

@@ -3134,10 +3134,10 @@ function resolveGithubToken2() {
 }
 
 // src/commands/init.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { resolve as resolve9 } from "path";
-import chalk11 from "chalk";
-import { Command as Command11 } from "commander";
+import { readFileSync as readFileSync12 } from "fs";
+import { resolve as resolve10 } from "path";
+import chalk12 from "chalk";
+import { Command as Command12 } from "commander";
 import inquirer5 from "inquirer";
 
 // src/lib/build-freshness.ts
@@ -3459,1116 +3459,1437 @@ async function resolveRepoIds(github, config) {
   }
 }
 
-// src/commands/init.ts
-var initCommand = new Command11("init").description("Scaffold a new project from the Biffo template").option("-c, --config <path>", "Path to a pre-filled biffo.config.json").option("--dry-run", "Validate config without making any changes").option("--fresh", "Ignore any saved session and start from scratch").option("-y, --yes", "Auto-accept detected credentials without prompting (implied by --config)").action(
-  async (options) => {
+// src/lib/root-sibling.ts
+var ROOT_SIBLING_NAME = "app";
+var RESERVED_SIBLING_NAMES = ["admin", "login", ROOT_SIBLING_NAME];
+function isRootPathPrefix(pathPrefix) {
+  return pathPrefix === "";
+}
+function registryNameFor(pathPrefix) {
+  return isRootPathPrefix(pathPrefix) ? ROOT_SIBLING_NAME : pathPrefix;
+}
+function displayPath(pathPrefix) {
+  return isRootPathPrefix(pathPrefix) ? "/" : `/${pathPrefix}`;
+}
+function basePathFor(pathPrefix) {
+  return isRootPathPrefix(pathPrefix) ? "" : `/${pathPrefix}`;
+}
+function rootSiblingProjectName(coreProjectName) {
+  return `${coreProjectName}-app`;
+}
+function bucketRegionalDomain(bucketName, region) {
+  return region === "us-east-1" ? `${bucketName}.s3.amazonaws.com` : `${bucketName}.s3.${region}.amazonaws.com`;
+}
+function siteBucketName(projectName, environment, accountId) {
+  return `${projectName}-${environment}-site-${accountId}`;
+}
+function upsertSiblingOrigin(existing, entry) {
+  return [...existing.filter((s) => s.name !== entry.name), entry];
+}
+function serializeRegistry(origins) {
+  return JSON.stringify({ sibling_origins: origins }, null, 2) + "\n";
+}
+
+// src/config/sibling-schema.ts
+import { z as z4 } from "zod";
+var SiblingConfigSchema = z4.object({
+  $schema: z4.string().optional(),
+  project: z4.object({
+    name: z4.string().min(1).regex(
+      /^[a-z][a-z0-9-]*$/,
+      "Must be lowercase kebab-case, starting with a letter (it becomes a URL path segment)"
+    ),
+    description: z4.string().default(""),
+    // Notable routes this sibling exposes, shown as labelled links on the
+    // core project's Microservices tab (ADR-0007). Each `path` is relative to
+    // the sibling's own path_prefix (so "demo" renders as /<prefix>/demo), and
+    // `label` is the human name. Empty by default — a sibling with no declared
+    // routes just shows its single root link. Declare real routes here as you
+    // build the sibling's pages; the values flow to the core's
+    // siblings.auto.tfvars.json at registration and into siblings.json at deploy.
+    routes: z4.array(
+      z4.object({
+        path: z4.string().min(1).regex(
+          /^[a-z0-9][a-z0-9/-]*$/,
+          'Sub-path relative to the sibling prefix, no leading slash (e.g. "demo" or "apply")'
+        ),
+        label: z4.string().min(1)
+      })
+    ).default([])
+  }),
+  source_control: SourceControlConfigSchema,
+  cloud: CloudConfigSchema,
+  environments: z4.array(z4.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
+  // The core project this sibling is paired with (ADR-0007) — never
+  // provisions its own Cognito pool or CloudFront distribution, always
+  // plugs into the core project's.
+  core: z4.object({
+    // Exactly one of these two must be set — see the superRefine below.
+    project_name: z4.string().min(1).optional().describe("Name of a project previously scaffolded with `biffo init` on this machine"),
+    config_path: z4.string().min(1).optional().describe(
+      "Path to the core project's biffo.config.json, for when it wasn't scaffolded here"
+    ),
+    // Defaults to project.name at parse time by the caller (sibling-create.ts),
+    // not here — z.object() has no access to sibling fields from within core's
+    // own schema without restructuring the whole object, and the caller
+    // already has both values in hand when it validates.
+    //
+    // The EMPTY string is meaningful and deliberately allowed: it is the
+    // root application sibling (issue #306), which serves `/` and takes the
+    // CDN's default_cache_behavior instead of a pair of ordered behaviours.
+    // It still registers under a non-empty reserved name ("app") — see
+    // lib/root-sibling.ts for why the two must not be conflated.
+    path_prefix: z4.string().regex(
+      /^$|^[a-z][a-z0-9-]*$/,
+      "Must be lowercase kebab-case, or empty for the root sibling"
+    ).optional()
+  })
+}).superRefine((config, ctx) => {
+  if (!config.core.project_name && !config.core.config_path) {
+    ctx.addIssue({
+      code: z4.ZodIssueCode.custom,
+      path: ["core"],
+      message: "Either core.project_name or core.config_path is required"
+    });
+  }
+});
+
+// src/commands/sibling-create.ts
+import { cpSync as cpSync2, existsSync as existsSync14, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { dirname as dirname6, join as join15, resolve as resolve9 } from "path";
+import chalk11 from "chalk";
+import { Command as Command11 } from "commander";
+
+// src/lib/sibling-session.ts
+import {
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync7,
+  readFileSync as readFileSync10,
+  rmSync as rmSync5,
+  statSync as statSync4,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join14 } from "path";
+function sessionsDir2() {
+  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join14(homedir3(), ".biffo", "sibling-sessions");
+}
+function sessionPath2(projectName) {
+  return join14(sessionsDir2(), `${projectName}.json`);
+}
+function findLatestSiblingSession() {
+  const dir = sessionsDir2();
+  if (!existsSync13(dir)) return null;
+  const files = readdirSync7(dir).filter((f) => f.endsWith(".json"));
+  if (files.length === 0) return null;
+  const sorted = files.map((f) => {
+    const fullPath = join14(dir, f);
+    const mtime = existsSync13(fullPath) ? statSync4(fullPath).mtimeMs : -1;
+    return { f, mtime };
+  }).sort((a, b) => b.mtime - a.mtime);
+  try {
+    return JSON.parse(readFileSync10(join14(dir, sorted[0].f), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function saveSiblingSession(session) {
+  const dir = sessionsDir2();
+  if (!existsSync13(dir)) mkdirSync5(dir, { recursive: true });
+  const name = session.config.project?.name ?? "unknown";
+  writeFileSync5(sessionPath2(name), JSON.stringify(session, null, 2));
+}
+function markSiblingStepComplete(session, step) {
+  if (!session.completedSteps.includes(step)) {
+    session.completedSteps.push(step);
+  }
+  saveSiblingSession(session);
+}
+function deleteSiblingSession(projectName) {
+  const path = sessionPath2(projectName);
+  if (existsSync13(path)) rmSync5(path);
+}
+
+// src/commands/sibling-create.ts
+var siblingCreateCommand = new Command11("create").description(
+  "Create a standalone sibling app repository from the Biffo sibling template (ADR-0007)"
+).argument("<name>", "Sibling name; must match config.project.name").requiredOption("-c, --config <path>", "Path to a pre-filled biffo.sibling.json").option("--template <path>", "Path to sibling template (defaults to the bundled skeleton)").option(
+  "--root",
+  `Create this sibling as the ROOT application: it serves "/" (empty path prefix) and takes the core distribution's default cache behaviour. Registered under the reserved name "${ROOT_SIBLING_NAME}". \`biffo init\` does this for you; use this flag only to re-create a root sibling by hand.`
+).option("--dry-run", "Validate config and print planned changes without creating anything").option("--fresh", "Ignore any saved session and start from scratch").action(
+  async (name, options) => {
     try {
       assertBuildIsFresh();
+      await runSiblingCreateCommand(name, {
+        configPath: resolve9(options.config),
+        templateRoot: options.template ? resolve9(options.template) : defaultSiblingTemplateRoot(),
+        root: options.root === true,
+        dryRun: options.dryRun === true,
+        fresh: options.fresh === true
+      });
     } catch (err) {
       log.error(err.message);
       process.exit(1);
     }
-    console.log(chalk11.bold("\n  Biffo \u2014 Project Initialiser\n"));
-    let session = null;
-    let config;
-    let githubToken;
-    if (options.config) {
-      const rawConfig = JSON.parse(readFileSync10(resolve9(options.config), "utf8"));
-      config = parseConfig(rawConfig);
-      const { account_id: accountId, region } = config.cloud.config;
-      session = {
-        version: 1,
-        config,
-        awsAccountId: accountId,
-        awsRegion: region,
-        completedSteps: [],
-        outputs: {}
-      };
-    } else {
-      githubToken = await resolveGithubToken3(options.yes === true);
-      const { accountId, region, profile } = await resolveAwsCredentials(options.yes === true);
-      if (!options.fresh) {
-        const saved = findLatestSession();
-        if (saved) {
-          const { resume } = await promptOr(
-            {
-              question: "Resume previous init?",
-              remedy: "Pass --fresh to ignore the saved session, or --config <path> to init from a file."
-            },
-            [
-              {
-                type: "confirm",
-                name: "resume",
-                message: `Resume previous init for ${chalk11.bold(saved.config.project?.name ?? "?")} (completed: ${saved.completedSteps.join(", ") || "none"})?`,
-                default: true
-              }
-            ]
-          );
-          if (resume) {
-            session = saved;
-            session.awsAccountId = accountId;
-            session.awsRegion = region;
-            config = applyResolvedAwsCredentials(parseConfig(session.config), {
-              accountId,
-              region,
-              profile
-            });
-            session.config = config;
-            saveSession(session);
-            console.log();
-          }
-        }
-      }
-      if (!session) {
-        const rawConfig = await promptForConfig(accountId, region, profile);
-        config = parseConfig(rawConfig);
-        session = {
-          version: 1,
-          config,
-          awsAccountId: accountId,
-          awsRegion: region,
-          completedSteps: [],
-          outputs: {}
-        };
-        saveSession(session);
-      }
-    }
-    config = config;
-    log.success("Configuration valid");
-    if (options.dryRun) {
-      console.log("\n", JSON.stringify(config, null, 2));
-      return;
+  }
+);
+async function runSiblingCreateCommand(name, options) {
+  console.log(chalk11.bold("\n  Biffo \u2014 Sibling App Creator\n"));
+  const config = readSiblingConfig(options.configPath, options.root);
+  if (config.project.name !== name) {
+    throw new Error(
+      `Sibling name '${name}' does not match config project.name '${config.project.name}'.`
+    );
+  }
+  assertPathPrefixIsAllowed(resolvePathPrefix(config));
+  const coreConfig = resolveCoreConfig(config, options.configPath);
+  if (options.dryRun) {
+    printDryRun2(config, coreConfig, options.templateRoot);
+    return;
+  }
+  if (!existsSync14(options.templateRoot)) {
+    throw new Error(`Sibling template not found at ${options.templateRoot}`);
+  }
+  let session = null;
+  if (!options.fresh) {
+    const saved = findLatestSiblingSession();
+    if (saved && saved.config.project?.name === name) {
+      session = saved;
+      console.log(
+        chalk11.dim(
+          `  Resuming previous sibling create for ${name} (completed: ${saved.completedSteps.join(", ") || "none"})
+`
+        )
+      );
     }
-    githubToken ??= await resolveGithubToken3(options.yes === true || Boolean(options.config));
-    const github = new GitHubAdapter(githubToken);
-    const aws = new AwsAdapter(config);
-    await runInit(github, aws, config, session);
-    const { org, repo } = config.source_control.config;
-    log.success("\nProject initialised successfully!");
-    console.log(`
+  }
+  if (!session) {
+    session = {
+      version: 1,
+      config,
+      awsAccountId: config.cloud.config.account_id,
+      awsRegion: config.cloud.config.region,
+      completedSteps: [],
+      outputs: {}
+    };
+    saveSiblingSession(session);
+  }
+  const token = await resolveGithubToken3(true);
+  const github = new GitHubAdapter(token);
+  const aws = new AwsAdapter(config);
+  const coreAws = new AwsAdapter(coreConfig);
+  const git = new GitAdapter();
+  await runSiblingCreate(github, aws, coreAws, git, config, session, {
+    coreConfig,
+    skeletonRoot: options.templateRoot,
+    githubToken: token
+  });
+  const { org, repo } = githubRepo(config);
+  const pathPrefix = resolvePathPrefix(config);
+  log.success("\nSibling repo created successfully!");
+  console.log(`
   Repository: https://github.com/${org}/${repo}`);
-    console.log("  Next: clone your repo and run the first deploy\n");
+  console.log(`  Path:       ${displayPath(pathPrefix)}`);
+  if (session.outputs.registrationPrUrl) {
+    console.log(
+      `  Registration PR (against ${coreConfig.project.name}): ${session.outputs.registrationPrUrl}`
+    );
   }
-);
-async function runInit(github, aws, config, session) {
-  const totalSteps = 5;
+  console.log(
+    `
+  Next steps:
+  1. Merge the registration PR above \u2014 until it merges, baseurl.com${displayPath(pathPrefix)} won't route anywhere.
+  2. Add a SIBLING_GITHUB_TOKEN secret to this new repo (a PAT with repo scope) \u2014 needed by its
+     deploy workflow to export Terraform outputs as environment variables, same as the core project.
+  3. Push to \`dev\` (or run the Deploy workflow manually) to provision this sibling's own AWS resources.
+  4. Once the registration PR has ALSO merged and the core project has redeployed, set
+     PARENT_CLOUDFRONT_DISTRIBUTION_ARN on this repo and re-run its Deploy workflow \u2014 see this
+     repo's README, "The two-phase CDN registration".
+`
+  );
+}
+async function runSiblingCreate(github, aws, coreAws, git, config, session, options) {
+  const totalSteps = 7;
+  const { org, repo } = githubRepo(config);
+  const pathPrefix = resolvePathPrefix(config);
   if (!session.completedSteps.includes("verify_credentials")) {
     log.step(1, totalSteps, "Verifying AWS credentials...");
     await aws.verifyCredentials();
-    markStepComplete(session, "verify_credentials");
+    markSiblingStepComplete(session, "verify_credentials");
   } else {
     log.step(1, totalSteps, "AWS credentials already verified \u2014 skipping");
   }
-  if (!session.completedSteps.includes("create_repo")) {
-    log.step(2, totalSteps, "Creating GitHub repository...");
-    const cloneUrl = await github.createRepoFromTemplate(config);
+  if (options.skipCoreIdentity && !session.completedSteps.includes("resolve_core_identity")) {
+    log.step(
+      2,
+      totalSteps,
+      "Core project isn't deployed yet \u2014 deferring its identity (CORE_COGNITO_*, CORE_API_URL)"
+    );
+    session.outputs.coreIdentity = {};
+    markSiblingStepComplete(session, "resolve_core_identity");
+  } else if (!session.completedSteps.includes("resolve_core_identity")) {
+    log.step(2, totalSteps, "Resolving core project's identity...");
+    session.outputs.coreIdentity = await resolveCoreIdentity(
+      coreAws,
+      options.coreConfig,
+      config.environments
+    );
+    markSiblingStepComplete(session, "resolve_core_identity");
+  } else {
+    log.step(2, totalSteps, "Core identity already resolved \u2014 skipping");
+  }
+  const coreIdentity = session.outputs.coreIdentity;
+  if (!coreIdentity) {
+    throw new Error(
+      "internal error: resolve_core_identity did not populate session.outputs.coreIdentity"
+    );
+  }
+  if (!session.completedSteps.includes("create_repo")) {
+    log.step(3, totalSteps, "Creating GitHub repository and pushing sibling skeleton...");
+    const cloneUrl = await github.createEmptyRepo(
+      org,
+      repo,
+      config.project.description || void 0
+    );
     session.outputs.cloneUrl = cloneUrl;
-    markStepComplete(session, "create_repo");
+    await pushSkeleton(
+      git,
+      options.skeletonRoot,
+      cloneUrl,
+      config,
+      options.coreConfig,
+      options.githubToken
+    );
+    markSiblingStepComplete(session, "create_repo");
   } else {
-    log.step(2, totalSteps, "GitHub repository already created \u2014 skipping");
+    log.step(3, totalSteps, "GitHub repository already created \u2014 skipping");
   }
   if (!session.completedSteps.includes("oidc_trust")) {
-    log.step(3, totalSteps, "Configuring OIDC trust...");
-    const roleArn = await aws.setupOidcTrust(config, await resolveRepoIds(github, config));
-    session.outputs.oidcRoleArn = roleArn;
-    config.cloud.config = {
-      ...config.cloud.config,
-      oidc_role_arn: roleArn
-    };
-    markStepComplete(session, "oidc_trust");
+    log.step(4, totalSteps, "Configuring OIDC trust...");
+    session.outputs.oidcRoleArn = await aws.setupOidcTrust(
+      config,
+      await resolveRepoIds(github, config)
+    );
+    markSiblingStepComplete(session, "oidc_trust");
   } else {
-    log.step(3, totalSteps, "OIDC trust already configured \u2014 skipping");
-    if (session.outputs.oidcRoleArn) {
-      config.cloud.config = {
-        ...config.cloud.config,
-        oidc_role_arn: session.outputs.oidcRoleArn
-      };
-    }
+    log.step(4, totalSteps, "OIDC trust already configured \u2014 skipping");
   }
   if (!session.completedSteps.includes("terraform_backend")) {
-    log.step(4, totalSteps, "Bootstrapping Terraform state backend...");
-    const tfStateBucket = await aws.bootstrapTerraformBackend(config.project.name);
-    session.outputs.tfStateBucket = tfStateBucket;
-    config.cloud.config = {
-      ...config.cloud.config,
-      tf_state_bucket: tfStateBucket
-    };
-    markStepComplete(session, "terraform_backend");
+    log.step(5, totalSteps, "Bootstrapping Terraform state backend...");
+    session.outputs.tfStateBucket = await aws.bootstrapTerraformBackend(config.project.name);
+    markSiblingStepComplete(session, "terraform_backend");
   } else {
-    log.step(4, totalSteps, "Terraform backend already bootstrapped \u2014 skipping");
-    if (session.outputs.tfStateBucket) {
-      config.cloud.config = {
-        ...config.cloud.config,
-        tf_state_bucket: session.outputs.tfStateBucket
-      };
-    }
+    log.step(5, totalSteps, "Terraform backend already bootstrapped \u2014 skipping");
   }
   if (!session.completedSteps.includes("github_config")) {
-    log.step(5, totalSteps, "Configuring GitHub repository...");
-    const { org, repo } = config.source_control.config;
-    const dns = resolveDnsConfig(config);
-    const domain = dns.domain;
-    await github.createBranch(org, repo, "dev", "main");
-    await github.createBranch(org, repo, "staging", "main");
-    await writeInstanceFiles(github, org, repo);
-    await github.setDefaultBranch(org, repo, "dev");
-    await github.configureBranchProtection(config);
-    await github.createEnvironments(config);
-    await github.enableVulnerabilityAlerts(org, repo);
-    await github.setRepoVariable(org, repo, "DNS_MODE", dns.mode);
-    if (domain) {
-      await github.setRepoVariable(org, repo, "DOMAIN", domain);
-    }
-    if (domain) {
-      const envDomains = {
-        dev: `dev.${domain}`,
-        staging: `staging.${domain}`,
-        prod: domain
-      };
-      for (const env of config.environments) {
-        const customDomain = envDomains[env] ?? "";
-        if (customDomain) {
-          await github.setEnvVariable(org, repo, env, "CUSTOM_DOMAIN", customDomain);
-        }
-      }
-    }
-    if (session.outputs.oidcRoleArn) {
-      await github.setRepoSecret(org, repo, "BIFFO_OIDC_ROLE_ARN", session.outputs.oidcRoleArn);
-    }
-    markStepComplete(session, "github_config");
+    log.step(6, totalSteps, "Configuring GitHub repository...");
+    await configureSiblingGithub(github, config, options.coreConfig, session, coreIdentity);
+    markSiblingStepComplete(session, "github_config");
   } else {
-    log.step(5, totalSteps, "GitHub already configured \u2014 skipping");
+    log.step(6, totalSteps, "GitHub already configured \u2014 skipping");
   }
-  deleteSession(config.project.name);
-  saveProjectConfig(config);
+  if (options.skipRegistration && !session.completedSteps.includes("register_with_core")) {
+    log.step(7, totalSteps, "Already registered with the core project by `biffo init` \u2014 skipping");
+    markSiblingStepComplete(session, "register_with_core");
+  } else if (!session.completedSteps.includes("register_with_core")) {
+    log.step(7, totalSteps, "Opening a registration PR against the core project...");
+    session.outputs.registrationPrUrl = await registerWithCore(
+      git,
+      github,
+      config,
+      options.coreConfig,
+      pathPrefix,
+      options.githubToken
+    );
+    markSiblingStepComplete(session, "register_with_core");
+  } else {
+    log.step(7, totalSteps, "Already registered with the core project \u2014 skipping");
+  }
+  deleteSiblingSession(config.project.name);
 }
-var INSTANCE_CONFIG_FILE = "biffo.config.json";
-var INSTANCE_FILE_BRANCHES = ["main", "dev", "staging"];
-async function writeInstanceFiles(github, org, repo) {
-  const files = [
-    { path: INSTANCE_CORE_FILE, content: serializeInstanceCoreVersion(getLatestCoreVersion()) },
-    { path: INSTANCE_CONFIG_FILE, content: null }
-  ];
-  for (const branch of INSTANCE_FILE_BRANCHES) {
-    await github.commitFiles(
-      org,
-      repo,
-      branch,
-      files,
-      `chore: record core version and drop the template ${INSTANCE_CONFIG_FILE}`
+function resolvePathPrefix(config) {
+  return config.core.path_prefix ?? config.project.name;
+}
+function assertPathPrefixIsAllowed(pathPrefix) {
+  if (isRootPathPrefix(pathPrefix)) return;
+  if (RESERVED_SIBLING_NAMES.includes(pathPrefix)) {
+    const extra = pathPrefix === ROOT_SIBLING_NAME ? ` "${ROOT_SIBLING_NAME}" is the root application sibling, which \`biffo init\` creates; pass --root to create one by hand.` : ` "${pathPrefix}" is one of the portal's own routes.`;
+    throw new Error(
+      `Sibling path prefix "${pathPrefix}" is reserved (${RESERVED_SIBLING_NAMES.join(", ")}).` + extra
     );
   }
 }
-function parseConfig(raw) {
-  const result = BiffoConfigSchema.safeParse(raw);
+function readSiblingConfig(path, root = false) {
+  const raw = JSON.parse(readFileSync11(path, "utf8"));
+  const withDefaults = raw && typeof raw === "object" && "project" in raw && "core" in raw ? {
+    ...raw,
+    core: {
+      ...raw.core,
+      // --root wins over whatever the file says: it is the whole point of
+      // the flag, and a config carrying a stale non-empty prefix would
+      // otherwise silently produce a path-routed sibling instead.
+      path_prefix: root ? "" : raw.core.path_prefix ?? raw.project.name
+    }
+  } : raw;
+  const result = SiblingConfigSchema.safeParse(withDefaults);
   if (!result.success) {
-    log.error("Invalid configuration:");
-    result.error.issues.forEach((issue) => {
-      log.error(`  ${issue.path.join(".")} \u2014 ${issue.message}`);
-    });
-    process.exit(1);
+    throw new Error(
+      "Invalid sibling configuration:\n" + result.error.issues.map((issue) => `  ${issue.path.join(".")} \u2014 ${issue.message}`).join("\n")
+    );
   }
   return result.data;
 }
-function applyResolvedAwsCredentials(config, credentials) {
-  return {
-    ...config,
-    cloud: {
-      provider: "aws",
-      config: {
-        ...config.cloud.config,
-        account_id: credentials.accountId,
-        region: credentials.region,
-        ...credentials.profile ? { profile: credentials.profile } : {}
+function resolveCoreConfig(config, configPath) {
+  if (config.core.config_path) {
+    const corePath = resolve9(dirname6(configPath), config.core.config_path);
+    return parseCoreConfig(corePath);
+  }
+  if (config.core.project_name) {
+    const saved = loadProjectConfig(config.core.project_name);
+    if (saved) return saved;
+    throw new Error(
+      `Core project '${config.core.project_name}' was not found in ~/.biffo/projects. Set core.config_path to the core project biffo.config.json instead.`
+    );
+  }
+  throw new Error("Either core.project_name or core.config_path is required.");
+}
+function parseCoreConfig(path) {
+  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync11(path, "utf8")));
+  if (!result.success) {
+    throw new Error(
+      `Invalid core configuration at ${path}:
+` + result.error.issues.map((issue) => `  ${issue.path.join(".")} \u2014 ${issue.message}`).join("\n")
+    );
+  }
+  return result.data;
+}
+async function resolveCoreIdentity(coreAws, coreConfig, environments) {
+  const coreAwsConfig = coreConfig.cloud.config;
+  const stateBucket = coreAwsConfig.tf_state_bucket ?? `${coreConfig.project.name}-terraform-state-${coreAwsConfig.account_id}`;
+  const coreIdentity = {};
+  for (const env of environments) {
+    const stateKey = `${env}/terraform.tfstate`;
+    log.info(`Reading ${coreConfig.project.name}'s Terraform outputs for ${env}...`);
+    const outputs = await coreAws.readTerraformOutputs(stateBucket, stateKey);
+    for (const key of [
+      "cognito_user_pool_id",
+      "cognito_client_id",
+      "api_gateway_url",
+      "portal_url"
+    ]) {
+      if (!outputs[key]) {
+        throw new Error(
+          `${key} not found in ${coreConfig.project.name}'s Terraform outputs for ${env}. Has the core project been deployed to ${env}? Run \`biffo deploy ${env}\` from the core project first.`
+        );
       }
     }
-  };
+    coreIdentity[env] = {
+      cognitoUserPoolId: outputs["cognito_user_pool_id"],
+      cognitoClientId: outputs["cognito_client_id"],
+      apiUrl: outputs["api_gateway_url"],
+      portalUrl: outputs["portal_url"]
+    };
+  }
+  return coreIdentity;
 }
-async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
-  assertInteractive(
-    "Project configuration",
-    "Pass --config <path> with a pre-filled biffo.config.json (it implies -y)."
+async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, githubToken) {
+  const workDir = mkdtempSync4(join15(tmpdir4(), `biffo-sibling-${config.project.name}-`));
+  try {
+    writeSiblingTemplate(skeletonRoot, workDir, config, {
+      coreProjectName: coreConfig.project.name,
+      pathPrefix: resolvePathPrefix(config)
+    });
+    await git.init(workDir, "main");
+    await git.addRemote(workDir, "origin", cloneUrl);
+    await git.add(workDir, ["."]);
+    await git.commit(workDir, `feat: scaffold ${config.project.name} sibling app (ADR-0007)`);
+    await git.push(workDir, "main", { token: githubToken });
+  } finally {
+    git.cleanup(workDir);
+  }
+}
+function writeSiblingTemplate(templateRoot, targetDir, config, context) {
+  if (!existsSync14(templateRoot)) {
+    throw new Error(`Sibling template not found at ${templateRoot}`);
+  }
+  cpSync2(templateRoot, targetDir, { recursive: true });
+  writeFileSync6(
+    join15(targetDir, "biffo.sibling.json"),
+    JSON.stringify(
+      {
+        name: config.project.name,
+        core_project: context.coreProjectName,
+        path_prefix: context.pathPrefix,
+        ...config.project.description ? { description: config.project.description } : {},
+        // Always written (even when empty) so the field is discoverable — declare
+        // this sibling's notable routes here and they surface on the core's
+        // Microservices tab. See SiblingConfigSchema.project.routes.
+        routes: config.project.routes
+      },
+      null,
+      2
+    ) + "\n"
   );
-  const answers = await inquirer5.prompt([
-    {
-      type: "input",
-      name: "project_name",
-      message: "Project name (lowercase kebab-case):",
-      validate: (v) => /^[a-z0-9-]+$/.test(v) || "Must be lowercase kebab-case"
-    },
-    { type: "input", name: "project_description", message: "Project description:" },
-    {
-      type: "list",
-      name: "dns_mode",
-      message: "DNS / custom domain mode:",
-      choices: [
-        {
-          name: "Managed Route53 \u2014 create DNS zone, certificate, and records automatically",
-          value: "managed-route53"
-        },
-        {
-          name: "External DNS \u2014 request SSL certificate and print records for manual DNS changes",
-          value: "external"
-        },
-        {
-          name: "None \u2014 use the default CloudFront domain only",
-          value: "none"
-        }
-      ],
-      default: "managed-route53"
-    },
-    {
-      type: "input",
-      name: "domain",
-      message: "Primary domain (e.g. myapp.com):",
-      when: (a) => a.dns_mode !== "none",
-      validate: (v) => v.trim().length > 0 || "Domain is required for this DNS mode"
-    },
-    { type: "input", name: "github_org", message: "GitHub org or username:" },
-    { type: "input", name: "github_repo", message: "Repository name (will be created):" },
-    { type: "input", name: "admin_email", message: "Admin email address:" },
-    { type: "input", name: "admin_username", message: "Admin username:" },
-    {
-      type: "checkbox",
-      name: "environments",
-      message: "Environments to provision:",
-      choices: ["dev", "staging", "prod"],
-      default: ["dev"]
+  const envPath = join15(targetDir, "apps", "frontend", ".env.example");
+  try {
+    const path = basePathFor(context.pathPrefix);
+    const content = readFileSync11(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
+    writeFileSync6(envPath, content);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+async function configureSiblingGithub(github, config, coreConfig, session, coreIdentity) {
+  const { org, repo } = githubRepo(config);
+  await github.createBranch(org, repo, "dev", "main");
+  await github.createBranch(org, repo, "staging", "main");
+  await github.setDefaultBranch(org, repo, "dev");
+  await github.configureBranchProtection(config);
+  await github.createEnvironments(config);
+  await github.enableVulnerabilityAlerts(org, repo);
+  await github.setRepoVariable(org, repo, "PROJECT_NAME", config.project.name);
+  await github.setRepoVariable(org, repo, "PATH_PREFIX", resolvePathPrefix(config));
+  await github.setRepoVariable(org, repo, "AWS_REGION", awsConfig(config).region);
+  await github.setRepoVariable(org, repo, "SIBLING_DEPLOY_ENABLED", "true");
+  try {
+    const { org: coreOrg, repo: coreRepo } = coreConfig.source_control.config;
+    const runnerLabel = await github.getRepoVariable(coreOrg, coreRepo, "RUNNER_LABEL");
+    if (runnerLabel && runnerLabel.trim()) {
+      await github.setRepoVariable(org, repo, "RUNNER_LABEL", runnerLabel);
     }
-  ]);
-  return {
-    project: {
-      name: answers.project_name,
-      description: answers.project_description
-    },
-    dns: {
-      mode: answers.dns_mode,
-      domain: answers.domain
-    },
-    source_control: {
-      provider: "github",
-      config: { org: answers.github_org, repo: answers.github_repo }
-    },
-    cloud: {
-      provider: "aws",
-      config: {
-        account_id: awsAccountId,
-        region: awsRegion,
-        ...awsProfile ? { profile: awsProfile } : {}
+  } catch (err) {
+    log.warn(
+      `Could not propagate RUNNER_LABEL from the core project to ${org}/${repo}: ${err.message}. The sibling will default to ubuntu-latest runners.`
+    );
+  }
+  if (session.outputs.tfStateBucket) {
+    await github.setRepoVariable(org, repo, "TF_STATE_BUCKET", session.outputs.tfStateBucket);
+  }
+  for (const env of config.environments) {
+    const identity = coreIdentity[env];
+    if (!identity) continue;
+    await github.setEnvVariable(
+      org,
+      repo,
+      env,
+      "CORE_COGNITO_USER_POOL_ID",
+      identity.cognitoUserPoolId
+    );
+    await github.setEnvVariable(org, repo, env, "CORE_COGNITO_CLIENT_ID", identity.cognitoClientId);
+    await github.setEnvVariable(org, repo, env, "CORE_API_URL", identity.apiUrl);
+    await github.setEnvVariable(org, repo, env, "CORE_PORTAL_URL", identity.portalUrl);
+    await github.setEnvVariable(
+      org,
+      repo,
+      env,
+      "CORS_ORIGINS_JSON",
+      JSON.stringify([identity.portalUrl])
+    );
+  }
+  if (session.outputs.oidcRoleArn) {
+    await github.setRepoSecret(org, repo, "SIBLING_OIDC_ROLE_ARN", session.outputs.oidcRoleArn);
+  }
+}
+function readExistingSiblingOrigins(filePath) {
+  try {
+    return JSON.parse(readFileSync11(filePath, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw err;
+  }
+}
+function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x") {
+  const cdnVarsPath = join15(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
+  let declaresSiblingOrigins = false;
+  try {
+    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync11(cdnVarsPath, "utf8"));
+  } catch {
+    declaresSiblingOrigins = false;
+  }
+  if (!declaresSiblingOrigins) {
+    throw new Error(
+      `The core project "${coreRepo}" doesn't support sibling CDN routing yet (its modules/cloud/aws/cdn predates ADR-0007). Run \`biffo core upgrade\` against it first, then re-run \`biffo sibling create\`.`
+    );
+  }
+  if (!isRootPathPrefix(pathPrefix)) return;
+  const cdnMainPath = join15(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
+  let supportsRoot = false;
+  try {
+    supportsRoot = /root_sibling_registered/.test(readFileSync11(cdnMainPath, "utf8"));
+  } catch {
+    supportsRoot = false;
+  }
+  if (!supportsRoot) {
+    throw new Error(
+      `The core project "${coreRepo}" doesn't support a ROOT application sibling yet (its modules/cloud/aws/cdn default_cache_behavior still can't follow the "${ROOT_SIBLING_NAME}" origin \u2014 issue #306). Run \`biffo core upgrade\` against it first, then re-run with --root.`
+    );
+  }
+}
+async function registerWithCore(git, github, config, coreConfig, pathPrefix, githubToken) {
+  const { org: coreOrg, repo: coreRepo } = coreConfig.source_control.config;
+  const coreCloneUrl = `https://github.com/${coreOrg}/${coreRepo}.git`;
+  const coreAwsRegion = awsConfig(coreConfig).region;
+  const siblingAccountId = config.cloud.config.account_id;
+  const cloneDir = await git.cloneForEditing(
+    coreCloneUrl,
+    `biffo-sibling-register-${config.project.name}`,
+    githubToken
+  );
+  const name = registryNameFor(pathPrefix);
+  try {
+    assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix);
+    const base = await git.currentBranch(cloneDir);
+    const branch = `biffo/register-sibling-${config.project.name}`.replace(/[^a-zA-Z0-9._/-]/g, "-");
+    await git.createBranch(cloneDir, branch);
+    const touchedFiles = [];
+    for (const env of config.environments) {
+      const bucketName = siteBucketName(config.project.name, env, siblingAccountId);
+      const domain = bucketRegionalDomain(bucketName, coreAwsRegion);
+      const relativePath = join15("infra", "environments", env, "siblings.auto.tfvars.json");
+      const filePath = join15(cloneDir, relativePath);
+      const existing = readExistingSiblingOrigins(filePath);
+      const siblings = upsertSiblingOrigin(existing.sibling_origins ?? [], {
+        name,
+        bucket_regional_domain: domain,
+        ...config.project.description ? { description: config.project.description } : {},
+        ...config.project.routes.length > 0 ? { routes: config.project.routes } : {}
+      });
+      mkdirSync6(dirname6(filePath), { recursive: true });
+      writeFileSync6(filePath, serializeRegistry(siblings));
+      touchedFiles.push(relativePath);
+    }
+    await git.add(cloneDir, touchedFiles);
+    await git.commit(
+      cloneDir,
+      isRootPathPrefix(pathPrefix) ? `infra(cdn): register root application sibling "${name}" at / (ADR-0007)` : `infra(cdn): register sibling "${name}" for path-based routing (ADR-0007)`
+    );
+    await git.push(cloneDir, branch, { token: githubToken });
+    const remoteUrl = await git.getRemoteUrl(cloneDir);
+    const { owner, repo } = parseGitHubRepo(remoteUrl);
+    const pr = await github.createPullRequest({
+      owner,
+      repo,
+      head: branch,
+      base,
+      title: isRootPathPrefix(pathPrefix) ? `Register root application sibling "${name}" at / (ADR-0007)` : `Register sibling "${name}" for CDN routing (ADR-0007)`,
+      body: buildRegistrationPrBody(config, pathPrefix, touchedFiles)
+    });
+    return pr.url;
+  } finally {
+    git.cleanup(cloneDir);
+  }
+}
+function buildRegistrationPrBody(config, pathPrefix, touchedFiles) {
+  const { org, repo } = githubRepo(config);
+  return [
+    "Automated sibling registration generated by `biffo sibling create` (ADR-0007).",
+    "",
+    isRootPathPrefix(pathPrefix) ? `Adds **${org}/${repo}** to this project's CloudFront distribution as the ROOT application origin (reserved name \`${ROOT_SIBLING_NAME}\`, empty path prefix) \u2014 once merged and redeployed, the distribution's \`default_cache_behavior\` targets that sibling's own S3 bucket, so \`baseurl.com/\` and everything not claimed by an explicit behaviour (\`/admin*\`, \`/login*\`, other siblings) routes there. That includes \`/_next/*\`, which the portal vacated by setting \`assetPrefix: '/admin'\`.` : `Adds **${org}/${repo}** to this project's CloudFront distribution as a new path-routed origin \u2014 once merged and redeployed, \`baseurl.com/${pathPrefix}/*\` routes to that sibling's own S3 bucket.`,
+    "",
+    `## Files changed (${touchedFiles.length})`,
+    "",
+    ...touchedFiles.map((f) => `- \`${f}\``),
+    "",
+    "## After merging",
+    "",
+    "This sibling's own S3 bucket policy still needs this distribution's real ARN (a two-phase handshake \u2014 see the sibling repo's README, \"The two-phase CDN registration\"). Once this PR merges and this project redeploys, set `PARENT_CLOUDFRONT_DISTRIBUTION_ARN` on the sibling repo and re-run its deploy workflow."
+  ].join("\n");
+}
+function printDryRun2(config, coreConfig, templateRoot) {
+  const { org, repo } = githubRepo(config);
+  const pathPrefix = resolvePathPrefix(config);
+  console.log(chalk11.bold("\n  Dry run \u2014 no changes will be made\n"));
+  console.log(`  Sibling:       ${config.project.name}`);
+  console.log(`  Repository:    ${org}/${repo}`);
+  console.log(`  Core project:  ${coreConfig.project.name}`);
+  console.log(
+    `  Path prefix:   ${displayPath(pathPrefix)}` + (isRootPathPrefix(pathPrefix) ? ` (ROOT application \u2014 registered as "${ROOT_SIBLING_NAME}", takes the CDN default behaviour)` : "")
+  );
+  console.log(`  Environments:  ${config.environments.join(", ")}`);
+  console.log(`  Template:      ${templateRoot}`);
+  console.log("\n  Would:");
+  console.log("    - resolve the core project's Cognito/API identity for each environment");
+  console.log("    - create an empty private sibling GitHub repository");
+  console.log("    - copy and rewrite _skeletons/sibling-template into the repo");
+  console.log("    - push main, create dev/staging, and set dev as default");
+  console.log("    - create AWS OIDC trust and a Terraform state bucket");
+  console.log("    - configure repository secrets, variables, environments, and branch protection");
+  console.log("    - open a PR against the core project to register this sibling for CDN routing\n");
+}
+function githubRepo(config) {
+  return config.source_control.config;
+}
+function awsConfig(config) {
+  return config.cloud.config;
+}
+function defaultSiblingTemplateRoot() {
+  let dir = dirname6(new URL(import.meta.url).pathname);
+  for (; ; ) {
+    const candidate = join15(dir, "_skeletons", "sibling-template");
+    if (existsSync14(candidate)) return candidate;
+    const parent = dirname6(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return resolve9(process.cwd(), "_skeletons", "sibling-template");
+}
+
+// src/commands/init.ts
+var initCommand = new Command12("init").description("Scaffold a new project from the Biffo template").option("-c, --config <path>", "Path to a pre-filled biffo.config.json").option("--dry-run", "Validate config without making any changes").option("--fresh", "Ignore any saved session and start from scratch").option("-y, --yes", "Auto-accept detected credentials without prompting (implied by --config)").action(
+  async (options) => {
+    try {
+      assertBuildIsFresh();
+    } catch (err) {
+      log.error(err.message);
+      process.exit(1);
+    }
+    console.log(chalk12.bold("\n  Biffo \u2014 Project Initialiser\n"));
+    let session = null;
+    let config;
+    let githubToken;
+    if (options.config) {
+      const rawConfig = JSON.parse(readFileSync12(resolve10(options.config), "utf8"));
+      config = parseConfig(rawConfig);
+      const { account_id: accountId, region } = config.cloud.config;
+      session = {
+        version: 1,
+        config,
+        awsAccountId: accountId,
+        awsRegion: region,
+        completedSteps: [],
+        outputs: {}
+      };
+    } else {
+      githubToken = await resolveGithubToken3(options.yes === true);
+      const { accountId, region, profile } = await resolveAwsCredentials(options.yes === true);
+      if (!options.fresh) {
+        const saved = findLatestSession();
+        if (saved) {
+          const { resume } = await promptOr(
+            {
+              question: "Resume previous init?",
+              remedy: "Pass --fresh to ignore the saved session, or --config <path> to init from a file."
+            },
+            [
+              {
+                type: "confirm",
+                name: "resume",
+                message: `Resume previous init for ${chalk12.bold(saved.config.project?.name ?? "?")} (completed: ${saved.completedSteps.join(", ") || "none"})?`,
+                default: true
+              }
+            ]
+          );
+          if (resume) {
+            session = saved;
+            session.awsAccountId = accountId;
+            session.awsRegion = region;
+            config = applyResolvedAwsCredentials(parseConfig(session.config), {
+              accountId,
+              region,
+              profile
+            });
+            session.config = config;
+            saveSession(session);
+            console.log();
+          }
+        }
       }
-    },
-    environments: answers.environments,
-    admin: { email: answers.admin_email, username: answers.admin_username }
-  };
-}
-
-// src/commands/plugin.ts
-import { Command as Command19 } from "commander";
-
-// src/commands/plugin-create.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
-import { dirname as dirname7, join as join16, resolve as resolve10 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-import chalk12 from "chalk";
-import { Command as Command12 } from "commander";
-
-// src/lib/plugin-locations.ts
-import { existsSync as existsSync13, readdirSync as readdirSync7 } from "fs";
-import { join as join14 } from "path";
-var FIRST_PARTY_PLUGINS_DIR = "_plugins";
-var PLUGIN_MANIFEST_FILE = "biffo.plugin.json";
-function pluginDir(name, channel) {
-  return channel === "first-party" ? `services/${FIRST_PARTY_PLUGINS_DIR}/${name}` : `services/${name}`;
-}
-function scanDir(absDir, relDir, channel) {
-  if (!existsSync13(absDir)) return [];
-  const found = [];
-  for (const entry of readdirSync7(absDir, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-    if (channel === "third-party" && entry.name === FIRST_PARTY_PLUGINS_DIR) continue;
-    const manifestPath = join14(absDir, entry.name, PLUGIN_MANIFEST_FILE);
-    if (!existsSync13(manifestPath)) continue;
-    found.push({
-      dirName: entry.name,
-      relDir: `${relDir}/${entry.name}`,
-      manifestPath,
-      channel
+      if (!session) {
+        const rawConfig = await promptForConfig(accountId, region, profile);
+        config = parseConfig(rawConfig);
+        session = {
+          version: 1,
+          config,
+          awsAccountId: accountId,
+          awsRegion: region,
+          completedSteps: [],
+          outputs: {}
+        };
+        saveSession(session);
+      }
+    }
+    config = config;
+    log.success("Configuration valid");
+    printPlan2(config);
+    if (options.dryRun) {
+      console.log("\n", JSON.stringify(config, null, 2));
+      return;
+    }
+    githubToken ??= await resolveGithubToken3(options.yes === true || Boolean(options.config));
+    const github = new GitHubAdapter(githubToken);
+    const aws = new AwsAdapter(config);
+    await runInit(github, aws, config, session, {
+      git: new GitAdapter(),
+      awsFor: (siblingConfig) => new AwsAdapter(siblingConfig),
+      skeletonRoot: defaultSiblingTemplateRoot(),
+      githubToken
     });
+    const { org, repo } = config.source_control.config;
+    const appRepo = rootSiblingProjectName(config.project.name);
+    log.success("\nProject initialised successfully!");
+    console.log(`
+  Platform:    https://github.com/${org}/${repo}`);
+    console.log(`  Application: https://github.com/${org}/${appRepo}   (serves /)`);
+    console.log(
+      `
+  Next:
+  1. Clone the platform repo and run its first deploy \u2014 /admin and /login come up with it.
+  2. Then deploy the application repo. Until it deploys, / has no content and 404s;
+     that window is expected.
+`
+    );
   }
-  return found;
-}
-function findInstalledPlugins(cwd) {
-  const servicesDir = join14(cwd, "services");
-  return [
-    ...scanDir(servicesDir, "services", "third-party"),
-    ...scanDir(
-      join14(servicesDir, FIRST_PARTY_PLUGINS_DIR),
-      `services/${FIRST_PARTY_PLUGINS_DIR}`,
-      "first-party"
-    )
-  ].sort((a, b) => a.relDir.localeCompare(b.relDir));
-}
-
-// src/lib/plugin-manifest.ts
-import { z as z4 } from "zod";
-var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["id", "tenant_id", "created_at", "updated_at"]);
-var COLUMN_TYPE_PATTERN = /^(String|Integer|Text|Boolean|Float|DateTime)(\(.*\))?$/;
-var ColumnDefinitionSchema = z4.object({
-  name: z4.string().refine(
-    (n) => !RESERVED_COLUMN_NAMES.has(n),
-    (n) => ({
-      message: `Column '${n}' is reserved and added automatically; it must not be declared in the manifest.`
-    })
-  ),
-  type: z4.string().regex(
-    COLUMN_TYPE_PATTERN,
-    "must be one of String, Integer, Text, Boolean, Float, DateTime (e.g. 'String(255)')"
-  ),
-  primary_key: z4.boolean().default(false),
-  nullable: z4.boolean().default(false),
-  index: z4.boolean().default(false),
-  default: z4.string().optional(),
-  description: z4.string().default("")
-});
-var IndexDefinitionSchema = z4.object({
-  name: z4.string(),
-  columns: z4.array(z4.string()).min(1),
-  unique: z4.boolean().default(false)
-});
-var PermissionRuleSchema = z4.object({
-  allowed: z4.boolean().default(false),
-  required_role: z4.array(z4.string()).default([])
-}).strict();
-var TablePermissionsSchema = z4.object({
-  list: PermissionRuleSchema.default({}),
-  read: PermissionRuleSchema.default({}),
-  create: PermissionRuleSchema.default({}),
-  update: PermissionRuleSchema.default({}),
-  delete: PermissionRuleSchema.default({})
-}).strict();
-var TableDefinitionSchema = z4.object({
-  name: z4.string().regex(/^[a-z][a-z0-9_]*$/, "table name must be snake_case, e.g. rbac_roles"),
-  columns: z4.array(ColumnDefinitionSchema).default([]),
-  indexes: z4.array(IndexDefinitionSchema).default([]),
-  permissions: TablePermissionsSchema.default({})
-}).superRefine((table, ctx) => {
-  const colCounts = /* @__PURE__ */ new Map();
-  for (const c of table.columns) colCounts.set(c.name, (colCounts.get(c.name) ?? 0) + 1);
-  for (const [name, count] of colCounts) {
-    if (count > 1) {
-      ctx.addIssue({
-        code: z4.ZodIssueCode.custom,
-        message: `Duplicate column name '${name}' in table '${table.name}'`
-      });
+);
+async function runInit(github, aws, config, session, appSibling) {
+  const totalSteps = appSibling ? 6 : 5;
+  if (!session.completedSteps.includes("verify_credentials")) {
+    log.step(1, totalSteps, "Verifying AWS credentials...");
+    await aws.verifyCredentials();
+    markStepComplete(session, "verify_credentials");
+  } else {
+    log.step(1, totalSteps, "AWS credentials already verified \u2014 skipping");
+  }
+  if (!session.completedSteps.includes("create_repo")) {
+    log.step(2, totalSteps, "Creating GitHub repository...");
+    const cloneUrl = await github.createRepoFromTemplate(config);
+    session.outputs.cloneUrl = cloneUrl;
+    markStepComplete(session, "create_repo");
+  } else {
+    log.step(2, totalSteps, "GitHub repository already created \u2014 skipping");
+  }
+  if (!session.completedSteps.includes("oidc_trust")) {
+    log.step(3, totalSteps, "Configuring OIDC trust...");
+    const roleArn = await aws.setupOidcTrust(config, await resolveRepoIds(github, config));
+    session.outputs.oidcRoleArn = roleArn;
+    config.cloud.config = {
+      ...config.cloud.config,
+      oidc_role_arn: roleArn
+    };
+    markStepComplete(session, "oidc_trust");
+  } else {
+    log.step(3, totalSteps, "OIDC trust already configured \u2014 skipping");
+    if (session.outputs.oidcRoleArn) {
+      config.cloud.config = {
+        ...config.cloud.config,
+        oidc_role_arn: session.outputs.oidcRoleArn
+      };
     }
   }
-  const idxCounts = /* @__PURE__ */ new Map();
-  for (const i of table.indexes) idxCounts.set(i.name, (idxCounts.get(i.name) ?? 0) + 1);
-  for (const [name, count] of idxCounts) {
-    if (count > 1) {
-      ctx.addIssue({
-        code: z4.ZodIssueCode.custom,
-        message: `Duplicate index name '${name}' in table '${table.name}'`
-      });
+  if (!session.completedSteps.includes("terraform_backend")) {
+    log.step(4, totalSteps, "Bootstrapping Terraform state backend...");
+    const tfStateBucket = await aws.bootstrapTerraformBackend(config.project.name);
+    session.outputs.tfStateBucket = tfStateBucket;
+    config.cloud.config = {
+      ...config.cloud.config,
+      tf_state_bucket: tfStateBucket
+    };
+    markStepComplete(session, "terraform_backend");
+  } else {
+    log.step(4, totalSteps, "Terraform backend already bootstrapped \u2014 skipping");
+    if (session.outputs.tfStateBucket) {
+      config.cloud.config = {
+        ...config.cloud.config,
+        tf_state_bucket: session.outputs.tfStateBucket
+      };
     }
   }
-  const validColumns = /* @__PURE__ */ new Set([...table.columns.map((c) => c.name), ...RESERVED_COLUMN_NAMES]);
-  for (const idx of table.indexes) {
-    for (const col of idx.columns) {
-      if (!validColumns.has(col)) {
-        ctx.addIssue({
-          code: z4.ZodIssueCode.custom,
-          message: `Index '${idx.name}' on table '${table.name}' references unknown column '${col}'`
-        });
+  if (!session.completedSteps.includes("github_config")) {
+    log.step(5, totalSteps, "Configuring GitHub repository...");
+    const { org, repo } = config.source_control.config;
+    const dns = resolveDnsConfig(config);
+    const domain = dns.domain;
+    await github.createBranch(org, repo, "dev", "main");
+    await github.createBranch(org, repo, "staging", "main");
+    await writeInstanceFiles(github, org, repo, config);
+    await github.setDefaultBranch(org, repo, "dev");
+    await github.configureBranchProtection(config);
+    await github.createEnvironments(config);
+    await github.enableVulnerabilityAlerts(org, repo);
+    await github.setRepoVariable(org, repo, "DNS_MODE", dns.mode);
+    if (domain) {
+      await github.setRepoVariable(org, repo, "DOMAIN", domain);
+    }
+    if (domain) {
+      const envDomains = {
+        dev: `dev.${domain}`,
+        staging: `staging.${domain}`,
+        prod: domain
+      };
+      for (const env of config.environments) {
+        const customDomain = envDomains[env] ?? "";
+        if (customDomain) {
+          await github.setEnvVariable(org, repo, env, "CUSTOM_DOMAIN", customDomain);
+        }
       }
     }
-  }
-});
-var OPERATION_METHODS = {
-  list: /* @__PURE__ */ new Set(["GET"]),
-  read: /* @__PURE__ */ new Set(["GET"]),
-  create: /* @__PURE__ */ new Set(["POST"]),
-  update: /* @__PURE__ */ new Set(["PUT", "PATCH"]),
-  delete: /* @__PURE__ */ new Set(["DELETE"])
-};
-var SINGLE_ROW_OPERATIONS = /* @__PURE__ */ new Set(["read", "update", "delete"]);
-var RouteDefSchema = z4.object({
-  method: z4.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
-  path: z4.string().startsWith("/", "path must start with '/'"),
-  table: z4.string(),
-  operation: z4.enum(["list", "read", "create", "update", "delete"]),
-  description: z4.string().default("")
-}).superRefine((route, ctx) => {
-  const allowed = OPERATION_METHODS[route.operation];
-  if (allowed && !allowed.has(route.method)) {
-    ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
-      message: `operation '${route.operation}' requires method in [${[...allowed].sort().join(", ")}], got '${route.method}'`
-    });
-  }
-  const hasId = route.path.includes("{id}");
-  const needsId = SINGLE_ROW_OPERATIONS.has(route.operation);
-  if (needsId && !hasId) {
-    ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
-      message: `operation '${route.operation}' addresses a single row and requires an '{id}' path parameter: ${route.path}`
-    });
-  }
-  if (!needsId && hasId) {
-    ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
-      message: `operation '${route.operation}' is collection-level and must not have an '{id}' path parameter: ${route.path}`
-    });
-  }
-});
-var PluginManifestSchema = z4.object({
-  name: z4.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
-  version: z4.string().regex(/^\d+\.\d+\.\d+$/, "must be a full semver, e.g. 1.2.3"),
-  description: z4.string().default(""),
-  author: z4.string().default("Biffo Team"),
-  tags: z4.array(z4.string()).default([]),
-  tables: z4.array(TableDefinitionSchema).default([]),
-  api_routes: z4.array(RouteDefSchema).default([]),
-  // Events the plugin reacts to. Parsed (rather than dropped as an unknown
-  // key) so `biffo plugin install` can warn when a plugin declares
-  // subscriptions but ships no terraform/ to route them — see #194 and
-  // lib/plugin-terraform-guard.ts. Kept loose deliberately: the authoritative
-  // schema is the registry's, and this consumer only needs to count them.
-  event_subscriptions: z4.array(z4.object({ source: z4.string(), detail_type: z4.string() }).passthrough()).default([]),
-  required_core_version: z4.string().default(">=0.0.0")
-}).superRefine((manifest, ctx) => {
-  const tableNames = new Set(manifest.tables.map((t) => t.name));
-  for (const route of manifest.api_routes) {
-    if (!tableNames.has(route.table)) {
-      ctx.addIssue({
-        code: z4.ZodIssueCode.custom,
-        message: `Route ${route.method} ${route.path} references table '${route.table}', which is not declared in this manifest's 'tables' (${[...tableNames].sort().join(", ") || "none"})`
-      });
+    if (session.outputs.oidcRoleArn) {
+      await github.setRepoSecret(org, repo, "BIFFO_OIDC_ROLE_ARN", session.outputs.oidcRoleArn);
     }
+    markStepComplete(session, "github_config");
+  } else {
+    log.step(5, totalSteps, "GitHub already configured \u2014 skipping");
   }
-});
-function validateManifest(raw) {
-  const result = PluginManifestSchema.safeParse(raw);
-  if (!result.success) {
-    const messages = result.error.issues.map((issue) => {
-      const path = issue.path.join(".");
-      return path ? `${path}: ${issue.message}` : issue.message;
-    }).join("; ");
-    throw new Error(messages);
+  if (appSibling) {
+    if (!session.completedSteps.includes("app_sibling")) {
+      log.step(6, totalSteps, "Creating the application sibling repository...");
+      await createAppSibling(github, config, session, appSibling);
+      markStepComplete(session, "app_sibling");
+    } else {
+      log.step(6, totalSteps, "Application sibling already created \u2014 skipping");
+    }
   }
-  return result.data;
+  deleteSession(config.project.name);
+  saveProjectConfig(config);
 }
-
-// src/lib/plugin-scaffold.ts
-import {
-  copyFileSync,
-  existsSync as existsSync14,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync11,
-  readdirSync as readdirSync8,
-  writeFileSync as writeFileSync5
-} from "fs";
-import { dirname as dirname6, join as join15 } from "path";
-var STANDALONE_ONLY_ENTRIES = {
-  ".github": "standalone-repo CI/release workflows \u2014 the host monorepo already runs lint/type/test/security over services/",
-  "registry-schema.json": "the plugin-registry publishing schema, used when submitting a *published* plugin to the registry repo, not by an in-tree plugin"
-};
-var NEVER_COPY = /* @__PURE__ */ new Set([
-  ".git",
-  ".venv",
-  "node_modules",
-  "__pycache__",
-  ".ruff_cache",
-  ".pytest_cache",
-  ".mypy_cache",
-  "dist",
-  "uv.lock",
-  ".DS_Store"
-]);
-var PLUGIN_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
-function deriveNames(slug) {
-  if (!PLUGIN_NAME_PATTERN.test(slug)) {
-    throw new Error(
-      `Invalid plugin name '${slug}'. Expected a lowercase kebab-case slug starting with a letter, e.g. 'acme-crm' (this is what biffo.plugin.json's 'name' field accepts, per registry-schema.json).`
-    );
-  }
-  const parts = slug.split("-");
-  return {
-    slug,
-    pkg: parts.join("_"),
-    pascal: parts.map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join(""),
-    dist: `biffo-plugin-${slug}`
+async function createAppSibling(github, config, session, deps) {
+  const siblingConfig = appSiblingConfig(config);
+  const cloud = config.cloud;
+  session.outputs.appSibling ??= {
+    version: 1,
+    config: siblingConfig,
+    awsAccountId: cloud.config.account_id,
+    awsRegion: cloud.config.region,
+    completedSteps: [],
+    outputs: {}
   };
+  const siblingSession = session.outputs.appSibling;
+  const siblingAws = deps.awsFor(siblingConfig);
+  await runSiblingCreate(github, siblingAws, siblingAws, deps.git, siblingConfig, siblingSession, {
+    coreConfig: config,
+    skeletonRoot: deps.skeletonRoot,
+    githubToken: deps.githubToken,
+    skipCoreIdentity: true,
+    skipRegistration: true
+  });
 }
-function substitutions(names) {
-  return [
-    [/biffo-plugin-example/g, names.dist],
-    [/ExamplePlugin/g, `${names.pascal}Plugin`],
-    // The example table. Table names are global in the instance's database, so
-    // leaving every scaffolded plugin with `example_widgets` would have the
-    // second one collide with the first at migration time.
-    [/example_widgets/g, `${names.pkg}_widgets`],
-    [/example_plugin/g, names.pkg],
-    [/example-plugin/g, names.slug]
-  ];
+function appSiblingConfig(config) {
+  const { org } = config.source_control.config;
+  const cloud = config.cloud;
+  const name = rootSiblingProjectName(config.project.name);
+  return SiblingConfigSchema.parse({
+    project: {
+      name,
+      description: `${config.project.description || config.project.name} \u2014 the user-facing application, served at /`
+    },
+    // Repo name === project name, deliberately and not incidentally:
+    // `resolveSiblingRepos()` (lib/sibling-teardown.ts) resolves a sibling's
+    // repo as `<coreOrg>/<projectName>`, recovering the project name from the
+    // S3 bucket in the registry. Let the two diverge and `biffo teardown`
+    // cannot find the repo it is meant to delete.
+    source_control: { provider: "github", config: { org, repo: name } },
+    // Identity only — account, region, profile. Deliberately NOT spread from
+    // the core's cloud config, which by this point in `runInit` also carries
+    // the CORE's `oidc_role_arn` and `tf_state_bucket`. The sibling gets its
+    // own of both (steps 4 and 5 of runSiblingCreate); inheriting the core's
+    // would either be silently wrong or, as an empty string mid-run, fail
+    // schema validation here and take the whole init down with it.
+    cloud: {
+      provider: "aws",
+      config: {
+        account_id: cloud.config.account_id,
+        region: cloud.config.region,
+        ...cloud.config.profile ? { profile: cloud.config.profile } : {}
+      }
+    },
+    environments: config.environments,
+    core: {
+      project_name: config.project.name,
+      // The empty prefix IS the root mode. It registers under the reserved,
+      // non-empty name "app" — see lib/root-sibling.ts on why those two must
+      // not be conflated.
+      path_prefix: ""
+    }
+  });
 }
-function applySubstitutions(text, names) {
-  let out = text;
-  for (const [pattern, replacement] of substitutions(names)) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
+function appSiblingRegistryFiles(config) {
+  const sibling = appSiblingConfig(config);
+  const { account_id: accountId, region } = config.cloud.config;
+  return config.environments.map((env) => ({
+    path: `infra/environments/${env}/siblings.auto.tfvars.json`,
+    content: serializeRegistry([
+      {
+        name: ROOT_SIBLING_NAME,
+        bucket_regional_domain: bucketRegionalDomain(
+          siteBucketName(sibling.project.name, env, accountId),
+          region
+        ),
+        description: sibling.project.description
+      }
+    ])
+  }));
 }
-var BINARY_EXTENSIONS = /\.(png|jpe?g|gif|ico|woff2?|ttf|zip|gz)$/i;
-function scaffoldPlugin(skeletonRoot, destDir, names) {
-  if (!existsSync14(skeletonRoot)) {
-    throw new Error(`Plugin skeleton not found at ${skeletonRoot}`);
+var INSTANCE_CONFIG_FILE = "biffo.config.json";
+var INSTANCE_FILE_BRANCHES = ["main", "dev", "staging"];
+async function writeInstanceFiles(github, org, repo, config) {
+  const files = [
+    { path: INSTANCE_CORE_FILE, content: serializeInstanceCoreVersion(getLatestCoreVersion()) },
+    { path: INSTANCE_CONFIG_FILE, content: null },
+    ...config ? appSiblingRegistryFiles(config) : []
+  ];
+  const message = config ? `chore: record core version, register the ${ROOT_SIBLING_NAME} sibling, and drop the template ${INSTANCE_CONFIG_FILE}` : `chore: record core version and drop the template ${INSTANCE_CONFIG_FILE}`;
+  for (const branch of INSTANCE_FILE_BRANCHES) {
+    await github.commitFiles(org, repo, branch, files, message);
   }
-  if (!existsSync14(join15(skeletonRoot, "terraform"))) {
-    throw new Error(
-      `Plugin skeleton at ${skeletonRoot} has no terraform/ directory. Refusing to scaffold a plugin that cannot receive events (issue #194) \u2014 the skeleton is broken.`
-    );
+}
+function printPlan2(config) {
+  const { org, repo } = config.source_control.config;
+  const appRepo = rootSiblingProjectName(config.project.name);
+  console.log(chalk12.bold("\n  This will create TWO GitHub repositories:\n"));
+  console.log(`    1. ${chalk12.bold(`${org}/${repo}`)}`);
+  console.log("       The platform \u2014 Core API, admin portal (/admin, /login), infrastructure.");
+  console.log(`    2. ${chalk12.bold(`${org}/${appRepo}`)}`);
+  console.log("       Your application \u2014 served at / (ADR-0007 sibling, issue #306).");
+  console.log(
+    `
+  Plus, in your AWS account: an OIDC role and a Terraform state bucket for each,
+  across ${config.environments.join(", ")}. \`biffo teardown\` removes both repositories
+  and everything they provision.
+`
+  );
+}
+function parseConfig(raw) {
+  const result = BiffoConfigSchema.safeParse(raw);
+  if (!result.success) {
+    log.error("Invalid configuration:");
+    result.error.issues.forEach((issue) => {
+      log.error(`  ${issue.path.join(".")} \u2014 ${issue.message}`);
+    });
+    process.exit(1);
   }
-  const skipped = [];
-  const files = [];
-  const walk = (relDir) => {
-    const absDir = join15(skeletonRoot, relDir);
-    for (const entry of readdirSync8(absDir, { withFileTypes: true }).sort(
-      (a, b) => a.name.localeCompare(b.name)
-    )) {
-      if (NEVER_COPY.has(entry.name)) continue;
-      if (relDir === "" && entry.name in STANDALONE_ONLY_ENTRIES) {
-        skipped.push({ entry: entry.name, reason: STANDALONE_ONLY_ENTRIES[entry.name] });
-        continue;
-      }
-      const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
-      if (entry.isDirectory()) {
-        walk(relPath);
-        continue;
-      }
-      const destRel = applySubstitutions(relPath, names);
-      const destPath = join15(destDir, destRel);
-      mkdirSync5(dirname6(destPath), { recursive: true });
-      if (BINARY_EXTENSIONS.test(entry.name)) {
-        copyFileSync(join15(skeletonRoot, relPath), destPath);
-      } else {
-        writeFileSync5(
-          destPath,
-          applySubstitutions(readFileSync11(join15(skeletonRoot, relPath), "utf8"), names)
-        );
+  return result.data;
+}
+function applyResolvedAwsCredentials(config, credentials) {
+  return {
+    ...config,
+    cloud: {
+      provider: "aws",
+      config: {
+        ...config.cloud.config,
+        account_id: credentials.accountId,
+        region: credentials.region,
+        ...credentials.profile ? { profile: credentials.profile } : {}
       }
-      files.push(destRel);
     }
   };
-  walk("");
-  if (!files.some((f) => f.startsWith("terraform/"))) {
-    throw new Error(
-      `Scaffold produced no terraform/ files from ${skeletonRoot} \u2014 refusing to leave a plugin whose event subscriptions could never fire (issue #194).`
-    );
-  }
-  return { files: files.sort(), skipped };
-}
-function findSkeletonRoot(startDir, skeleton) {
-  let dir = startDir;
-  for (; ; ) {
-    const candidate = join15(dir, "_skeletons", skeleton);
-    if (existsSync14(candidate)) return candidate;
-    const parent = dirname6(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
 }
-
-// src/commands/plugin-create.ts
-var pluginCreateCommand = new Command12("create").description("Scaffold a new plugin from the Biffo plugin skeleton: biffo plugin create <name>").argument("<name>", "Plugin name \u2014 lowercase kebab-case, e.g. acme-crm").option(
-  "--first-party",
-  "Scaffold into the template-owned services/_plugins/ carve-out. Only valid in the biffo-template repo itself \u2014 see notes."
-).option(
-  "--skeleton <path>",
-  "Path to the plugin skeleton (defaults to _skeletons/plugin-template)"
-).option("--dry-run", "Print planned changes without modifying the repo").option("--no-commit", "Scaffold the files but leave them uncommitted").option("--cwd <path>", "Project root to scaffold into (defaults to the current directory)").action(
-  async (name, options) => {
-    const cwd = options.cwd ? resolve10(options.cwd) : process.cwd();
-    try {
-      await runPluginCreate(
-        name,
+async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
+  assertInteractive(
+    "Project configuration",
+    "Pass --config <path> with a pre-filled biffo.config.json (it implies -y)."
+  );
+  const answers = await inquirer5.prompt([
+    {
+      type: "input",
+      name: "project_name",
+      message: "Project name (lowercase kebab-case):",
+      validate: (v) => /^[a-z0-9-]+$/.test(v) || "Must be lowercase kebab-case"
+    },
+    { type: "input", name: "project_description", message: "Project description:" },
+    {
+      type: "list",
+      name: "dns_mode",
+      message: "DNS / custom domain mode:",
+      choices: [
         {
-          firstParty: options.firstParty ?? false,
-          ...options.skeleton ? { skeletonRoot: resolve10(options.skeleton) } : {},
-          dryRun: options.dryRun ?? false,
-          commit: options.commit !== false,
-          cwd
+          name: "Managed Route53 \u2014 create DNS zone, certificate, and records automatically",
+          value: "managed-route53"
         },
-        { git: new GitAdapter() }
-      );
-    } catch (err) {
-      log.error(err.message);
-      process.exit(1);
-    }
-  }
-);
-async function runPluginCreate(name, options, deps) {
-  const names = deriveNames(name);
-  const isInstance = existsSync15(join16(options.cwd, INSTANCE_CORE_FILE));
-  if (options.firstParty && isInstance) {
-    throw new Error(
-      `--first-party scaffolds into services/_plugins/, which is template-owned: \`biffo core upgrade\` three-way-merges it against the template on every upgrade, and the template has no '${names.slug}'. This checkout is a Biffo instance (${INSTANCE_CORE_FILE} is present), so your plugin belongs in the user-owned ${pluginDir(names.slug, "third-party")}/ \u2014 re-run without --first-party.`
-    );
-  }
-  const channel = options.firstParty ? "first-party" : "third-party";
-  const relDir = pluginDir(names.slug, channel);
-  const destDir = join16(options.cwd, relDir);
-  const servicesDir = join16(options.cwd, "services");
-  if (!existsSync15(servicesDir)) {
-    throw new Error(
-      `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
-    );
-  }
-  if (existsSync15(destDir)) {
-    throw new Error(`${relDir}/ already exists. Choose a different name, or remove it first.`);
-  }
-  const here = dirname7(fileURLToPath4(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join16(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync15(skeletonRoot)) {
-    throw new Error(
-      `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
-    );
-  }
-  if (options.dryRun) {
-    printDryRun2(names, relDir, skeletonRoot, channel);
-    return;
-  }
-  const { files, skipped } = scaffoldPlugin(skeletonRoot, destDir, names);
-  log.success(`Scaffolded ${files.length} file(s) into ${relDir}/`);
-  for (const { entry, reason } of skipped) {
-    log.info(`Skipped ${entry} \u2014 ${reason}`);
-  }
-  const manifestPath = join16(destDir, "biffo.plugin.json");
-  const manifest = validateManifest(JSON.parse(readFileSync12(manifestPath, "utf8")));
-  if (manifest.name !== names.slug) {
-    throw new Error(
-      `Scaffolded manifest declares name '${manifest.name}', expected '${names.slug}'. The skeleton's manifest name may have diverged from 'example-plugin'.`
-    );
-  }
-  log.success(
-    `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
-  );
-  if (options.commit) {
-    if (!await deps.git.isGitRepo(options.cwd)) {
-      throw new Error(
-        `${options.cwd} is not a git repository \u2014 biffo plugin create must be run from a Biffo project checkout.`
-      );
+        {
+          name: "External DNS \u2014 request SSL certificate and print records for manual DNS changes",
+          value: "external"
+        },
+        {
+          name: "None \u2014 use the default CloudFront domain only",
+          value: "none"
+        }
+      ],
+      default: "managed-route53"
+    },
+    {
+      type: "input",
+      name: "domain",
+      message: "Primary domain (e.g. myapp.com):",
+      when: (a) => a.dns_mode !== "none",
+      validate: (v) => v.trim().length > 0 || "Domain is required for this DNS mode"
+    },
+    { type: "input", name: "github_org", message: "GitHub org or username:" },
+    { type: "input", name: "github_repo", message: "Repository name (will be created):" },
+    { type: "input", name: "admin_email", message: "Admin email address:" },
+    { type: "input", name: "admin_username", message: "Admin username:" },
+    {
+      type: "checkbox",
+      name: "environments",
+      message: "Environments to provision:",
+      choices: ["dev", "staging", "prod"],
+      default: ["dev"]
     }
-    const commitMessage = `feat(plugins): scaffold ${names.slug} plugin`;
-    await deps.git.add(options.cwd, [relDir]);
-    await deps.git.commit(options.cwd, commitMessage);
-    log.success(`Committed: ${commitMessage}`);
-  }
-  printNextSteps(names, relDir, channel);
-}
-function printDryRun2(names, relDir, skeletonRoot, channel) {
-  console.log(chalk12.bold("\n  Dry run \u2014 no changes will be made\n"));
-  console.log(`  Plugin:          ${names.slug}`);
-  console.log(`  Channel:         ${channel}`);
-  console.log(`  Would scaffold:  ${relDir}/`);
-  console.log(`  From skeleton:   ${skeletonRoot}`);
-  console.log(`  Python package:  ${names.pkg}   (dist: ${names.dist})`);
-  console.log(`  Would commit:    feat(plugins): scaffold ${names.slug} plugin
-`);
-}
-function printNextSteps(names, relDir, channel) {
-  console.log(chalk12.bold("\n  Plugin scaffolded!\n"));
-  console.log(`  ${relDir}/ contains a working example: one table, four CRUD routes,`);
-  console.log(`  one event subscription, and a terraform/ module for its Lambda.
-`);
-  console.log("  Next:");
-  console.log(chalk12.dim(`    1. Edit ${relDir}/biffo.plugin.json \u2014 your tables and routes`));
-  console.log(chalk12.dim(`    2. Edit ${relDir}/src/${names.pkg}/plugin.py \u2014 your event handlers`));
-  console.log(chalk12.dim(`    3. biffo plugin install --local ${relDir}`));
-  console.log(
-    chalk12.dim("       (copies terraform/ into modules/plugins/, generates the migration)\n")
-  );
-  if (channel === "first-party") {
-    log.warn(
-      `${relDir}/ is template-owned: it will be distributed to every instance by \`biffo core upgrade\`, and bumping core.version is required for it (ADR-0006).`
-    );
-  }
+  ]);
+  return {
+    project: {
+      name: answers.project_name,
+      description: answers.project_description
+    },
+    dns: {
+      mode: answers.dns_mode,
+      domain: answers.domain
+    },
+    source_control: {
+      provider: "github",
+      config: { org: answers.github_org, repo: answers.github_repo }
+    },
+    cloud: {
+      provider: "aws",
+      config: {
+        account_id: awsAccountId,
+        region: awsRegion,
+        ...awsProfile ? { profile: awsProfile } : {}
+      }
+    },
+    environments: answers.environments,
+    admin: { email: answers.admin_email, username: answers.admin_username }
+  };
 }
 
-// src/commands/plugin-info.ts
+// src/commands/plugin.ts
+import { Command as Command20 } from "commander";
+
+// src/commands/plugin-create.ts
+import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
+import { dirname as dirname8, join as join18, resolve as resolve11 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import chalk13 from "chalk";
 import { Command as Command13 } from "commander";
 
-// src/adapters/registry/index.ts
+// src/lib/plugin-locations.ts
+import { existsSync as existsSync15, readdirSync as readdirSync8 } from "fs";
+import { join as join16 } from "path";
+var FIRST_PARTY_PLUGINS_DIR = "_plugins";
+var PLUGIN_MANIFEST_FILE = "biffo.plugin.json";
+function pluginDir(name, channel) {
+  return channel === "first-party" ? `services/${FIRST_PARTY_PLUGINS_DIR}/${name}` : `services/${name}`;
+}
+function scanDir(absDir, relDir, channel) {
+  if (!existsSync15(absDir)) return [];
+  const found = [];
+  for (const entry of readdirSync8(absDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    if (channel === "third-party" && entry.name === FIRST_PARTY_PLUGINS_DIR) continue;
+    const manifestPath = join16(absDir, entry.name, PLUGIN_MANIFEST_FILE);
+    if (!existsSync15(manifestPath)) continue;
+    found.push({
+      dirName: entry.name,
+      relDir: `${relDir}/${entry.name}`,
+      manifestPath,
+      channel
+    });
+  }
+  return found;
+}
+function findInstalledPlugins(cwd) {
+  const servicesDir = join16(cwd, "services");
+  return [
+    ...scanDir(servicesDir, "services", "third-party"),
+    ...scanDir(
+      join16(servicesDir, FIRST_PARTY_PLUGINS_DIR),
+      `services/${FIRST_PARTY_PLUGINS_DIR}`,
+      "first-party"
+    )
+  ].sort((a, b) => a.relDir.localeCompare(b.relDir));
+}
+
+// src/lib/plugin-manifest.ts
 import { z as z5 } from "zod";
-var RegistryPluginEntrySchema = z5.object({
-  name: z5.string().regex(/^[a-z][a-z0-9-]*$/),
-  version: z5.string().regex(/^\d+\.\d+\.\d+$/),
-  minor_version: z5.string().regex(/^\d+\.\d+$/),
-  repo: z5.string().url(),
-  description: z5.string().optional(),
-  author: z5.string().optional(),
-  tags: z5.array(z5.string()).optional(),
-  required_core_version: z5.string().optional(),
-  infra_modules: z5.array(z5.string()).optional(),
-  api_routes: z5.array(z5.string()).optional(),
-  ui_components: z5.array(z5.string()).optional(),
-  status: z5.enum(["active", "disabled"])
+var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["id", "tenant_id", "created_at", "updated_at"]);
+var COLUMN_TYPE_PATTERN = /^(String|Integer|Text|Boolean|Float|DateTime)(\(.*\))?$/;
+var ColumnDefinitionSchema = z5.object({
+  name: z5.string().refine(
+    (n) => !RESERVED_COLUMN_NAMES.has(n),
+    (n) => ({
+      message: `Column '${n}' is reserved and added automatically; it must not be declared in the manifest.`
+    })
+  ),
+  type: z5.string().regex(
+    COLUMN_TYPE_PATTERN,
+    "must be one of String, Integer, Text, Boolean, Float, DateTime (e.g. 'String(255)')"
+  ),
+  primary_key: z5.boolean().default(false),
+  nullable: z5.boolean().default(false),
+  index: z5.boolean().default(false),
+  default: z5.string().optional(),
+  description: z5.string().default("")
 });
-var PluginRegistrySchema = z5.object({
-  schema_version: z5.string(),
-  last_updated: z5.string(),
-  plugins: z5.array(RegistryPluginEntrySchema)
+var IndexDefinitionSchema = z5.object({
+  name: z5.string(),
+  columns: z5.array(z5.string()).min(1),
+  unique: z5.boolean().default(false)
 });
-var DEFAULT_REGISTRY_URL = "https://raw.githubusercontent.com/keiranholloway/biffo-plugins-registry/main/plugins.json";
-var RegistryAdapter = class {
-  registryUrl;
-  constructor(registryUrl) {
-    this.registryUrl = registryUrl ?? process.env["BIFFO_REGISTRY_URL"] ?? DEFAULT_REGISTRY_URL;
-  }
-  /** Fetches and validates plugins.json from the registry. */
-  async fetchRegistry() {
-    let response;
-    try {
-      response = await fetch(this.registryUrl);
-    } catch (err) {
-      throw new Error(
-        `Could not reach the plugin registry at ${this.registryUrl}: ${err.message}`
-      );
-    }
-    if (!response.ok) {
-      throw new Error(
-        `Plugin registry returned ${response.status} ${response.statusText} (${this.registryUrl})`
-      );
-    }
-    let raw;
-    try {
-      raw = await response.json();
-    } catch (err) {
-      throw new Error(
-        `Plugin registry at ${this.registryUrl} did not return valid JSON: ${err.message}`
-      );
-    }
-    const result = PluginRegistrySchema.safeParse(raw);
-    if (!result.success) {
-      const messages = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
-      throw new Error(
-        `Plugin registry at ${this.registryUrl} has an invalid shape: ${messages.join("; ")}`
-      );
-    }
-    return result.data;
-  }
-  /**
-   * Resolves `name@minorVersion` (e.g. "rbac", "1.0") against the registry.
-   *
-   * The registry stores one entry per plugin — its current release — not a
-   * full version history, so "resolving the latest patch for a minor"
-   * degenerates to an exact match against that single entry's
-   * `minor_version`. True multi-version history isn't representable in the
-   * registry schema today; see PR description for this known limitation.
-   */
-  async resolvePlugin(name, minorVersion) {
-    const registry = await this.fetchRegistry();
-    const candidates = registry.plugins.filter((p) => p.name === name);
-    if (candidates.length === 0) {
-      throw new Error(`Plugin '${name}' was not found in the registry (${this.registryUrl}).`);
-    }
-    const match = candidates.find((p) => p.minor_version === minorVersion);
-    if (!match) {
-      const available = candidates.map((p) => `${p.name}@${p.minor_version} (${p.status})`);
-      throw new Error(
-        `No version matching '${name}@${minorVersion}' found in the registry. Available: ${available.join(", ")}`
-      );
-    }
-    if (match.status !== "active") {
-      throw new Error(
-        `Plugin '${name}@${minorVersion}' is disabled in the registry and cannot be installed.`
-      );
+var PermissionRuleSchema = z5.object({
+  allowed: z5.boolean().default(false),
+  required_role: z5.array(z5.string()).default([])
+}).strict();
+var TablePermissionsSchema = z5.object({
+  list: PermissionRuleSchema.default({}),
+  read: PermissionRuleSchema.default({}),
+  create: PermissionRuleSchema.default({}),
+  update: PermissionRuleSchema.default({}),
+  delete: PermissionRuleSchema.default({})
+}).strict();
+var TableDefinitionSchema = z5.object({
+  name: z5.string().regex(/^[a-z][a-z0-9_]*$/, "table name must be snake_case, e.g. rbac_roles"),
+  columns: z5.array(ColumnDefinitionSchema).default([]),
+  indexes: z5.array(IndexDefinitionSchema).default([]),
+  permissions: TablePermissionsSchema.default({})
+}).superRefine((table, ctx) => {
+  const colCounts = /* @__PURE__ */ new Map();
+  for (const c of table.columns) colCounts.set(c.name, (colCounts.get(c.name) ?? 0) + 1);
+  for (const [name, count] of colCounts) {
+    if (count > 1) {
+      ctx.addIssue({
+        code: z5.ZodIssueCode.custom,
+        message: `Duplicate column name '${name}' in table '${table.name}'`
+      });
     }
-    return match;
-  }
-};
-
-// src/commands/plugin-info.ts
-var pluginInfoCommand = new Command13("info").description("Show registry details for a plugin: biffo plugin info <name>").argument("<name>", "Plugin name").action(async (name) => {
-  try {
-    await runPluginInfo(name, { registry: new RegistryAdapter() });
-  } catch (err) {
-    log.error(err.message);
-    process.exit(1);
   }
-});
-async function runPluginInfo(name, deps) {
-  const registry = await deps.registry.fetchRegistry();
-  const matches = registry.plugins.filter((p) => p.name === name);
-  if (matches.length === 0) {
-    throw new Error(`Plugin '${name}' was not found in the registry.`);
-  }
-  for (const entry of matches) {
-    printEntry(entry);
-  }
-}
-function printEntry(entry) {
-  console.log(chalk13.bold(`
-  ${entry.name}@${entry.version}
-`));
-  console.log(`  Status:                 ${entry.status}`);
-  console.log(`  Minor version channel:  ${entry.minor_version}`);
-  console.log(`  Repo:                   ${entry.repo}`);
-  if (entry.description) console.log(`  Description:            ${entry.description}`);
-  if (entry.author) console.log(`  Author:                 ${entry.author}`);
-  if (entry.tags?.length) console.log(`  Tags:                   ${entry.tags.join(", ")}`);
-  if (entry.required_core_version) {
-    console.log(`  Required core version:  ${entry.required_core_version}`);
-  }
-  if (entry.infra_modules?.length) {
-    console.log(`  Infra modules:          ${entry.infra_modules.join(", ")}`);
-  }
-  if (entry.api_routes?.length) {
-    console.log(`  API routes:             ${entry.api_routes.join(", ")}`);
-  }
-  if (entry.ui_components?.length) {
-    console.log(`  UI components:          ${entry.ui_components.join(", ")}`);
-  }
-  console.log("");
-}
-
-// src/commands/plugin-install.ts
-import { cpSync as cpSync2, existsSync as existsSync17, mkdirSync as mkdirSync7, readFileSync as readFileSync14, statSync as statSync4 } from "fs";
-import { basename, join as join19, relative as relative3, resolve as resolve11 } from "path";
-import chalk14 from "chalk";
-import { Command as Command14 } from "commander";
-
-// src/adapters/plugin-migrations/index.ts
-import { execa as execa3 } from "execa";
-import { join as join17 } from "path";
-var PluginMigrationsAdapter = class {
-  /**
-   * Generates migration file(s) for `pluginNames` (every discovered
-   * installed plugin if omitted), returning the absolute path of each newly
-   * generated file — empty if every named plugin already had a migration,
-   * or declared no tables.
-   */
-  async generate(cwd, pluginNames) {
-    const scriptPath = join17(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
-    const args = [
-      "run",
-      "python",
-      scriptPath,
-      "--services-root",
-      join17(cwd, "services"),
-      "--versions-dir",
-      join17(cwd, "services", "api", "migrations", "versions")
-    ];
-    for (const name of pluginNames ?? []) {
-      args.push("--plugin", name);
+  const idxCounts = /* @__PURE__ */ new Map();
+  for (const i of table.indexes) idxCounts.set(i.name, (idxCounts.get(i.name) ?? 0) + 1);
+  for (const [name, count] of idxCounts) {
+    if (count > 1) {
+      ctx.addIssue({
+        code: z5.ZodIssueCode.custom,
+        message: `Duplicate index name '${name}' in table '${table.name}'`
+      });
     }
-    let result;
-    try {
-      result = await execa3("uv", args, { cwd: join17(cwd, "services", "api") });
-    } catch (err) {
-      const cause = err;
-      if (cause.code === "ENOENT") {
-        throw new Error(
-          "biffo plugin install/upgrade/sync-migrations needs `uv` (Python) on PATH to generate a real migration file \u2014 see https://docs.astral.sh/uv/ to install it. Once installed, re-run this command (or `biffo plugin sync-migrations <name>` if services/<name>/ is already copied in)."
-        );
+  }
+  const validColumns = /* @__PURE__ */ new Set([...table.columns.map((c) => c.name), ...RESERVED_COLUMN_NAMES]);
+  for (const idx of table.indexes) {
+    for (const col of idx.columns) {
+      if (!validColumns.has(col)) {
+        ctx.addIssue({
+          code: z5.ZodIssueCode.custom,
+          message: `Index '${idx.name}' on table '${table.name}' references unknown column '${col}'`
+        });
       }
-      throw new Error(
-        `Failed to generate plugin migration: ${cause.stderr?.trim() || err.message}`
-      );
     }
-    return result.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
   }
+});
+var OPERATION_METHODS = {
+  list: /* @__PURE__ */ new Set(["GET"]),
+  read: /* @__PURE__ */ new Set(["GET"]),
+  create: /* @__PURE__ */ new Set(["POST"]),
+  update: /* @__PURE__ */ new Set(["PUT", "PATCH"]),
+  delete: /* @__PURE__ */ new Set(["DELETE"])
 };
-
-// src/lib/plugin-terraform-wiring.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync6, readFileSync as readFileSync13, readdirSync as readdirSync9, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
-import { join as join18 } from "path";
-var TEMPLATE_MODULE_DIR = "_template";
-var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
-var GENERATED_TF_FILE = "plugins.generated.tf";
-var GENERATED_TFVARS_FILE = "plugins.auto.tfvars.json";
-function standardArguments(pluginName, handler) {
-  return [
-    ["project_name", "var.project_name"],
-    ["environment", "local.environment"],
-    ["plugin_name", JSON.stringify(pluginName)],
-    ["handler", JSON.stringify(handler)],
-    ["event_bus_name", "module.events.event_bus_name"],
-    ["core_api_url", "module.api_gateway.api_endpoint"],
-    ["core_api_execution_arn", "module.api_gateway.execution_arn"],
-    ["tags", "local.tags"]
-  ];
-}
-function listPluginModules(cwd) {
-  const dir = join18(cwd, "modules", "plugins");
-  let entries;
-  try {
-    entries = readdirSync9(dir, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-  return entries.filter((e) => e.isDirectory() && e.name !== TEMPLATE_MODULE_DIR && !e.name.startsWith(".")).map((e) => e.name).sort();
-}
-function listEnvironments(cwd) {
-  const dir = join18(cwd, "infra", "environments");
-  let entries;
-  try {
-    entries = readdirSync9(dir, { withFileTypes: true });
-  } catch {
-    return [];
+var SINGLE_ROW_OPERATIONS = /* @__PURE__ */ new Set(["read", "update", "delete"]);
+var RouteDefSchema = z5.object({
+  method: z5.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
+  path: z5.string().startsWith("/", "path must start with '/'"),
+  table: z5.string(),
+  operation: z5.enum(["list", "read", "create", "update", "delete"]),
+  description: z5.string().default("")
+}).superRefine((route, ctx) => {
+  const allowed = OPERATION_METHODS[route.operation];
+  if (allowed && !allowed.has(route.method)) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      message: `operation '${route.operation}' requires method in [${[...allowed].sort().join(", ")}], got '${route.method}'`
+    });
   }
-  return entries.filter((e) => {
-    if (!e.isDirectory() || !existsSync16(join18(dir, e.name, "main.tf"))) return false;
-    return declaredVariables(join18(dir, e.name)).has("enabled_plugins");
-  }).map((e) => e.name).sort();
-}
-function listUnwirableEnvironments(cwd) {
-  const dir = join18(cwd, "infra", "environments");
-  let entries;
-  try {
-    entries = readdirSync9(dir, { withFileTypes: true });
-  } catch {
-    return [];
+  const hasId = route.path.includes("{id}");
+  const needsId = SINGLE_ROW_OPERATIONS.has(route.operation);
+  if (needsId && !hasId) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      message: `operation '${route.operation}' addresses a single row and requires an '{id}' path parameter: ${route.path}`
+    });
   }
-  return entries.filter(
-    (e) => e.isDirectory() && existsSync16(join18(dir, e.name, "main.tf")) && !declaredVariables(join18(dir, e.name)).has("enabled_plugins")
-  ).map((e) => e.name).sort();
-}
-function declaredVariables(moduleDir) {
-  const names = /* @__PURE__ */ new Set();
-  let entries;
-  try {
-    entries = readdirSync9(moduleDir, { withFileTypes: true });
-  } catch {
-    return names;
+  if (!needsId && hasId) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      message: `operation '${route.operation}' is collection-level and must not have an '{id}' path parameter: ${route.path}`
+    });
   }
-  for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
-    let contents;
-    try {
-      contents = readFileSync13(join18(moduleDir, entry.name), "utf8");
-    } catch {
-      continue;
-    }
-    for (const match of contents.matchAll(/^\s*variable\s+"([^"]+)"/gm)) {
-      names.add(match[1]);
+});
+var PluginManifestSchema = z5.object({
+  name: z5.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
+  version: z5.string().regex(/^\d+\.\d+\.\d+$/, "must be a full semver, e.g. 1.2.3"),
+  description: z5.string().default(""),
+  author: z5.string().default("Biffo Team"),
+  tags: z5.array(z5.string()).default([]),
+  tables: z5.array(TableDefinitionSchema).default([]),
+  api_routes: z5.array(RouteDefSchema).default([]),
+  // Events the plugin reacts to. Parsed (rather than dropped as an unknown
+  // key) so `biffo plugin install` can warn when a plugin declares
+  // subscriptions but ships no terraform/ to route them — see #194 and
+  // lib/plugin-terraform-guard.ts. Kept loose deliberately: the authoritative
+  // schema is the registry's, and this consumer only needs to count them.
+  event_subscriptions: z5.array(z5.object({ source: z5.string(), detail_type: z5.string() }).passthrough()).default([]),
+  required_core_version: z5.string().default(">=0.0.0")
+}).superRefine((manifest, ctx) => {
+  const tableNames = new Set(manifest.tables.map((t) => t.name));
+  for (const route of manifest.api_routes) {
+    if (!tableNames.has(route.table)) {
+      ctx.addIssue({
+        code: z5.ZodIssueCode.custom,
+        message: `Route ${route.method} ${route.path} references table '${route.table}', which is not declared in this manifest's 'tables' (${[...tableNames].sort().join(", ") || "none"})`
+      });
     }
   }
-  return names;
+});
+function validateManifest(raw) {
+  const result = PluginManifestSchema.safeParse(raw);
+  if (!result.success) {
+    const messages = result.error.issues.map((issue) => {
+      const path = issue.path.join(".");
+      return path ? `${path}: ${issue.message}` : issue.message;
+    }).join("; ");
+    throw new Error(messages);
+  }
+  return result.data;
 }
-function renderArguments(args, indent) {
-  const width = Math.max(...args.map(([key]) => key.length));
-  return args.map(([key, value]) => `${indent}${key.padEnd(width)} = ${value}`).join("\n");
+
+// src/lib/plugin-scaffold.ts
+import {
+  copyFileSync,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync13,
+  readdirSync as readdirSync9,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { dirname as dirname7, join as join17 } from "path";
+var STANDALONE_ONLY_ENTRIES = {
+  ".github": "standalone-repo CI/release workflows \u2014 the host monorepo already runs lint/type/test/security over services/",
+  "registry-schema.json": "the plugin-registry publishing schema, used when submitting a *published* plugin to the registry repo, not by an in-tree plugin"
+};
+var NEVER_COPY = /* @__PURE__ */ new Set([
+  ".git",
+  ".venv",
+  "node_modules",
+  "__pycache__",
+  ".ruff_cache",
+  ".pytest_cache",
+  ".mypy_cache",
+  "dist",
+  "uv.lock",
+  ".DS_Store"
+]);
+var PLUGIN_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+function deriveNames(slug) {
+  if (!PLUGIN_NAME_PATTERN.test(slug)) {
+    throw new Error(
+      `Invalid plugin name '${slug}'. Expected a lowercase kebab-case slug starting with a letter, e.g. 'acme-crm' (this is what biffo.plugin.json's 'name' field accepts, per registry-schema.json).`
+    );
+  }
+  const parts = slug.split("-");
+  return {
+    slug,
+    pkg: parts.join("_"),
+    pascal: parts.map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join(""),
+    dist: `biffo-plugin-${slug}`
+  };
 }
-function renderModuleBlock(pluginName, declared, handler) {
-  const args = standardArguments(pluginName, handler).filter(([key]) => declared.has(key));
-  const quoted = JSON.stringify(pluginName);
+function substitutions(names) {
   return [
-    `module "plugin_${pluginName}" {`,
-    `  source   = "../../../modules/plugins/${pluginName}"`,
-    `  for_each = contains(var.enabled_plugins, ${quoted}) ? { ${quoted} = true } : {}`,
-    "",
-    renderArguments(args, "  "),
-    "}",
-    "",
-    `output "plugin_${pluginName}_function_arn" {`,
-    `  description = "Lambda ARN of the ${pluginName} plugin, or null when it is not in enabled_plugins."`,
-    `  value       = try(module.plugin_${pluginName}[${quoted}].function_arn, null)`,
-    "}"
-  ].join("\n");
-}
-var GENERATED_HEADER = `# ---------------------------------------------------------------------------
-# GENERATED FILE \u2014 DO NOT EDIT BY HAND.
-#
-# Written by \`biffo plugin install\` / \`biffo plugin uninstall\` (issue #201),
-# regenerated in full from the contents of modules/plugins/. Any manual edit is
-# lost on the next plugin install or uninstall.
-#
-# Terraform loads every *.tf file in this directory, so these blocks are as
-# live as anything in main.tf \u2014 they simply live in a CLI-owned file so the
-# CLI never has to rewrite your hand-authored main.tf.
-#
-# Terraform requires a module's \`source\` to be a static string literal, so it
-# cannot loop over var.enabled_plugins; hence one explicit block per plugin,
-# each gated on membership in enabled_plugins (supplied by the generated
-# ${GENERATED_TFVARS_FILE} alongside this file).
-#
-# Not generated here: the Core API's BIFFO_SERVICE_PRINCIPAL_ARN_ALLOWLIST
-# (ADR-0009). It lives in main.tf and is derived from var.enabled_plugins as a
-# static role-name glob \u2014 deriving it from a plugin module's role_arn output
-# would create the cycle core_api -> api_gateway -> plugin -> core_api.
-# ---------------------------------------------------------------------------
-`;
-function renderGeneratedTerraform(plugins) {
-  const blocks = plugins.map(
-    (p) => renderModuleBlock(p.name, p.declaredVariables, p.handler ?? DEFAULT_PLUGIN_HANDLER)
-  );
-  return `${GENERATED_HEADER}
-${blocks.join("\n\n")}
-`;
+    [/biffo-plugin-example/g, names.dist],
+    [/ExamplePlugin/g, `${names.pascal}Plugin`],
+    // The example table. Table names are global in the instance's database, so
+    // leaving every scaffolded plugin with `example_widgets` would have the
+    // second one collide with the first at migration time.
+    [/example_widgets/g, `${names.pkg}_widgets`],
+    [/example_plugin/g, names.pkg],
+    [/example-plugin/g, names.slug]
+  ];
 }
-function renderGeneratedTfvars(pluginNames) {
-  return `${JSON.stringify({ enabled_plugins: pluginNames }, null, 2)}
-`;
+function applySubstitutions(text, names) {
+  let out = text;
+  for (const [pattern, replacement] of substitutions(names)) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
 }
-function syncPluginTerraform(cwd) {
-  const plugins = listPluginModules(cwd);
-  const environments = listEnvironments(cwd);
-  const skippedEnvironments = listUnwirableEnvironments(cwd);
-  const changedPaths = [];
-  const rendered = plugins.map((name) => ({
-    name,
-    declaredVariables: declaredVariables(join18(cwd, "modules", "plugins", name))
-  }));
-  for (const env of environments) {
-    const envDir = join18(cwd, "infra", "environments", env);
-    const tfPath = join18(envDir, GENERATED_TF_FILE);
-    const tfvarsPath = join18(envDir, GENERATED_TFVARS_FILE);
-    const relBase = `infra/environments/${env}`;
-    if (plugins.length === 0) {
-      for (const [abs, rel] of [
-        [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
-        [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
-      ]) {
-        if (existsSync16(abs)) {
-          rmSync5(abs);
-          changedPaths.push(rel);
-        }
+var BINARY_EXTENSIONS = /\.(png|jpe?g|gif|ico|woff2?|ttf|zip|gz)$/i;
+function scaffoldPlugin(skeletonRoot, destDir, names) {
+  if (!existsSync16(skeletonRoot)) {
+    throw new Error(`Plugin skeleton not found at ${skeletonRoot}`);
+  }
+  if (!existsSync16(join17(skeletonRoot, "terraform"))) {
+    throw new Error(
+      `Plugin skeleton at ${skeletonRoot} has no terraform/ directory. Refusing to scaffold a plugin that cannot receive events (issue #194) \u2014 the skeleton is broken.`
+    );
+  }
+  const skipped = [];
+  const files = [];
+  const walk = (relDir) => {
+    const absDir = join17(skeletonRoot, relDir);
+    for (const entry of readdirSync9(absDir, { withFileTypes: true }).sort(
+      (a, b) => a.name.localeCompare(b.name)
+    )) {
+      if (NEVER_COPY.has(entry.name)) continue;
+      if (relDir === "" && entry.name in STANDALONE_ONLY_ENTRIES) {
+        skipped.push({ entry: entry.name, reason: STANDALONE_ONLY_ENTRIES[entry.name] });
+        continue;
       }
-      continue;
+      const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        walk(relPath);
+        continue;
+      }
+      const destRel = applySubstitutions(relPath, names);
+      const destPath = join17(destDir, destRel);
+      mkdirSync7(dirname7(destPath), { recursive: true });
+      if (BINARY_EXTENSIONS.test(entry.name)) {
+        copyFileSync(join17(skeletonRoot, relPath), destPath);
+      } else {
+        writeFileSync7(
+          destPath,
+          applySubstitutions(readFileSync13(join17(skeletonRoot, relPath), "utf8"), names)
+        );
+      }
+      files.push(destRel);
     }
-    mkdirSync6(envDir, { recursive: true });
-    writeFileSync6(tfPath, renderGeneratedTerraform(rendered));
-    writeFileSync6(tfvarsPath, renderGeneratedTfvars(plugins));
-    changedPaths.push(`${relBase}/${GENERATED_TF_FILE}`, `${relBase}/${GENERATED_TFVARS_FILE}`);
+  };
+  walk("");
+  if (!files.some((f) => f.startsWith("terraform/"))) {
+    throw new Error(
+      `Scaffold produced no terraform/ files from ${skeletonRoot} \u2014 refusing to leave a plugin whose event subscriptions could never fire (issue #194).`
+    );
+  }
+  return { files: files.sort(), skipped };
+}
+function findSkeletonRoot(startDir, skeleton) {
+  let dir = startDir;
+  for (; ; ) {
+    const candidate = join17(dir, "_skeletons", skeleton);
+    if (existsSync16(candidate)) return candidate;
+    const parent = dirname7(dir);
+    if (parent === dir) return null;
+    dir = parent;
   }
-  return { plugins, environments, skippedEnvironments, changedPaths };
 }
 
-// src/commands/plugin-install.ts
-var TARGET_PATTERN = /^([a-z][a-z0-9-]*)@(\d+\.\d+)$/;
-var pluginInstallCommand = new Command14("install").description(
-  "Install a plugin from the Biffo plugin registry (biffo plugin install <name>@<minor>) or from a local directory (biffo plugin install --local <path>)"
-).argument("[target]", "Plugin name and minor version, e.g. rbac@1.0 (omit when using --local)").option(
-  "--local <path>",
-  "Install from a local, unpublished plugin directory instead of the registry"
-).option("--dry-run", "Resolve the plugin and print planned changes without modifying the repo").option("--cwd <path>", "Project root to install into (defaults to the current directory)").action(
-  async (target, options) => {
+// src/commands/plugin-create.ts
+var pluginCreateCommand = new Command13("create").description("Scaffold a new plugin from the Biffo plugin skeleton: biffo plugin create <name>").argument("<name>", "Plugin name \u2014 lowercase kebab-case, e.g. acme-crm").option(
+  "--first-party",
+  "Scaffold into the template-owned services/_plugins/ carve-out. Only valid in the biffo-template repo itself \u2014 see notes."
+).option(
+  "--skeleton <path>",
+  "Path to the plugin skeleton (defaults to _skeletons/plugin-template)"
+).option("--dry-run", "Print planned changes without modifying the repo").option("--no-commit", "Scaffold the files but leave them uncommitted").option("--cwd <path>", "Project root to scaffold into (defaults to the current directory)").action(
+  async (name, options) => {
     const cwd = options.cwd ? resolve11(options.cwd) : process.cwd();
     try {
-      await runPluginInstall(
-        target,
+      await runPluginCreate(
+        name,
         {
-          ...options.local ? { local: resolve11(options.local) } : {},
+          firstParty: options.firstParty ?? false,
+          ...options.skeleton ? { skeletonRoot: resolve11(options.skeleton) } : {},
           dryRun: options.dryRun ?? false,
+          commit: options.commit !== false,
           cwd
         },
-        {
-          registry: new RegistryAdapter(),
-          git: new GitAdapter(),
-          migrations: new PluginMigrationsAdapter()
-        }
+        { git: new GitAdapter() }
       );
     } catch (err) {
       log.error(err.message);
@@ -4576,384 +4897,468 @@ var pluginInstallCommand = new Command14("install").description(
     }
   }
 );
-var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
-  ".git",
-  ".venv",
-  "node_modules",
-  "__pycache__",
-  ".ruff_cache",
-  ".pytest_cache",
-  ".mypy_cache",
-  "dist",
-  ".terraform"
-]);
-function resolveLocalPlugin(localPath) {
-  if (!existsSync17(localPath)) {
-    throw new Error(`--local path does not exist: ${localPath}`);
-  }
-  if (!statSync4(localPath).isDirectory()) {
-    throw new Error(`--local path is not a directory: ${localPath}`);
-  }
-  const manifestPath = join19(localPath, "biffo.plugin.json");
-  if (!existsSync17(manifestPath)) {
-    throw new Error(
-      `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
-    );
-  }
-  const manifest = validateManifest(parseManifestFile(manifestPath));
-  return {
-    name: manifest.name,
-    version: manifest.version,
-    manifest,
-    sourceDir: localPath,
-    origin: localPath,
-    cleanup: () => {
-    }
-  };
-}
-function parsePluginTarget(target) {
-  const match = TARGET_PATTERN.exec(target);
-  if (!match) {
-    throw new Error(`Invalid target '${target}'. Expected format: <name>@<minor>, e.g. rbac@1.0`);
-  }
-  return { name: match[1], minor: match[2] };
-}
-async function cloneAndValidatePlugin(entry, git) {
-  const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
-  try {
-    const manifestPath = join19(tmpDir, "biffo.plugin.json");
-    if (!existsSync17(manifestPath)) {
-      throw new Error(
-        `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
-      );
-    }
-    const manifest = validateManifest(parseManifestFile(manifestPath));
-    if (manifest.name !== entry.name) {
-      throw new Error(
-        `Manifest name '${manifest.name}' in ${entry.repo} does not match the registry entry '${entry.name}'.`
-      );
-    }
-    return { tmpDir, manifest };
-  } catch (err) {
-    git.cleanup(tmpDir);
-    throw err;
-  }
-}
-async function runPluginInstall(target, options, deps) {
-  if (options.local && target) {
-    throw new Error(
-      `Pass either a registry target (<name>@<minor>) or --local <path>, not both. --local installs an unpublished plugin from disk and has no registry entry to resolve.`
-    );
-  }
-  if (!options.local && !target) {
+async function runPluginCreate(name, options, deps) {
+  const names = deriveNames(name);
+  const isInstance = existsSync17(join18(options.cwd, INSTANCE_CORE_FILE));
+  if (options.firstParty && isInstance) {
     throw new Error(
-      `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
+      `--first-party scaffolds into services/_plugins/, which is template-owned: \`biffo core upgrade\` three-way-merges it against the template on every upgrade, and the template has no '${names.slug}'. This checkout is a Biffo instance (${INSTANCE_CORE_FILE} is present), so your plugin belongs in the user-owned ${pluginDir(names.slug, "third-party")}/ \u2014 re-run without --first-party.`
     );
   }
-  const servicesDir = join19(options.cwd, "services");
+  const channel = options.firstParty ? "first-party" : "third-party";
+  const relDir = pluginDir(names.slug, channel);
+  const destDir = join18(options.cwd, relDir);
+  const servicesDir = join18(options.cwd, "services");
   if (!existsSync17(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  let source;
-  let entry = null;
-  if (options.local) {
-    source = resolveLocalPlugin(options.local);
-    log.success(`Resolved ${source.name}@${source.version} from ${source.origin}`);
-  } else {
-    const { name, minor } = parsePluginTarget(target);
-    log.info(`Resolving ${name}@${minor} from the plugin registry...`);
-    entry = await deps.registry.resolvePlugin(name, minor);
-    log.success(`Resolved ${entry.name}@${entry.version} \u2014 ${entry.repo}`);
+  if (existsSync17(destDir)) {
+    throw new Error(`${relDir}/ already exists. Choose a different name, or remove it first.`);
   }
-  const pluginName = entry ? entry.name : source.name;
-  const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join19(options.cwd, relTargetDir);
-  const modulesDir = join19(options.cwd, "modules", "plugins", pluginName);
-  const inTreeSource = options.local !== void 0 && resolve11(options.local) === resolve11(targetDir);
-  if (existsSync17(targetDir) && !inTreeSource) {
+  const here = dirname8(fileURLToPath4(import.meta.url));
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join18(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync17(skeletonRoot)) {
     throw new Error(
-      `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
+      `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
   }
   if (options.dryRun) {
-    printDryRun3(entry, source, relTargetDir, inTreeSource);
+    printDryRun3(names, relDir, skeletonRoot, channel);
     return;
   }
-  const isRepo = await deps.git.isGitRepo(options.cwd);
-  if (!isRepo) {
+  const { files, skipped } = scaffoldPlugin(skeletonRoot, destDir, names);
+  log.success(`Scaffolded ${files.length} file(s) into ${relDir}/`);
+  for (const { entry, reason } of skipped) {
+    log.info(`Skipped ${entry} \u2014 ${reason}`);
+  }
+  const manifestPath = join18(destDir, "biffo.plugin.json");
+  const manifest = validateManifest(JSON.parse(readFileSync14(manifestPath, "utf8")));
+  if (manifest.name !== names.slug) {
     throw new Error(
-      `${options.cwd} is not a git repository \u2014 biffo plugin install must be run from a Biffo project checkout.`
+      `Scaffolded manifest declares name '${manifest.name}', expected '${names.slug}'. The skeleton's manifest name may have diverged from 'example-plugin'.`
     );
   }
-  if (entry) {
-    log.info(`Cloning ${entry.repo}...`);
-    const cloned = await cloneAndValidatePlugin(entry, deps.git);
-    source = {
-      name: entry.name,
-      version: entry.version,
-      manifest: cloned.manifest,
-      sourceDir: cloned.tmpDir,
-      origin: entry.repo,
-      cleanup: () => deps.git.cleanup(cloned.tmpDir)
-    };
-  }
-  const { manifest } = source;
-  try {
-    log.success(
-      `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
-    );
-    if (inTreeSource) {
-      log.info(`${relTargetDir}/ is already in this checkout \u2014 installing in place.`);
-    } else {
-      mkdirSync7(targetDir, { recursive: true });
-      cpSync2(source.sourceDir, targetDir, {
-        recursive: true,
-        filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename(src))
-      });
-      log.success(`Installed plugin source at ${relTargetDir}/`);
-    }
-    const stagePaths = [relTargetDir];
-    const tfSourceDir = join19(targetDir, "terraform");
-    if (existsSync17(tfSourceDir)) {
-      mkdirSync7(modulesDir, { recursive: true });
-      cpSync2(tfSourceDir, modulesDir, { recursive: true });
-      stagePaths.push(`modules/plugins/${pluginName}`);
-      log.success(`Copied Terraform module to modules/plugins/${pluginName}/`);
-      const wiring = syncPluginTerraform(options.cwd);
-      stagePaths.push(...wiring.changedPaths);
-      if (wiring.environments.length > 0) {
-        log.success(
-          `Wired module "plugin_${pluginName}" and enabled_plugins into ${wiring.environments.length} environment(s): ${wiring.environments.join(", ")}`
-        );
-        log.info(
-          "The Core API allowlist (ADR-0009) follows automatically \u2014 local.plugin_service_principal_arns in main.tf derives it from enabled_plugins."
-        );
-      } else {
-        log.warn(
-          "No wirable infra/environments/*/ root config found, so the Terraform module was copied but not wired into any environment."
-        );
-      }
-      if (wiring.skippedEnvironments.length > 0) {
-        log.warn(
-          `Skipped ${wiring.skippedEnvironments.join(", ")} \u2014 no \`enabled_plugins\` variable declared there. infra/ is user-owned, so \`biffo core upgrade\` cannot add it: copy the variable (and local.plugin_service_principal_arns) from the template\u2019s infra/environments/dev/ and re-run this install to wire those environments.`
-        );
-      }
-    } else if (manifest.event_subscriptions.length > 0) {
-      log.warn(
-        `Plugin "${pluginName}" declares ${manifest.event_subscriptions.length} event subscription(s) but ships no terraform/ directory, so no Lambda or EventBridge rule was created \u2014 those events will never reach it. Add a terraform/ module (start from modules/plugins/_template/) and reinstall.`
+  log.success(
+    `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
+  );
+  if (options.commit) {
+    if (!await deps.git.isGitRepo(options.cwd)) {
+      throw new Error(
+        `${options.cwd} is not a git repository \u2014 biffo plugin create must be run from a Biffo project checkout.`
       );
     }
-    if (manifest.tables.length > 0) {
-      log.info(`Generating migration for ${relTargetDir}/'s ${manifest.tables.length} table(s)...`);
-      const generatedPaths = await deps.migrations.generate(options.cwd, [pluginName]);
-      for (const absPath of generatedPaths) {
-        stagePaths.push(relative3(options.cwd, absPath));
-      }
-      if (generatedPaths.length > 0) {
-        log.success(`Generated migration: ${relative3(options.cwd, generatedPaths[0])}`);
-      }
-    } else {
-      log.info(`${pluginName} declares no tables \u2014 nothing to migrate.`);
-    }
-    const commitMessage = `feat(plugins): install ${pluginName}@${source.version}`;
-    await deps.git.add(options.cwd, stagePaths);
+    const commitMessage = `feat(plugins): scaffold ${names.slug} plugin`;
+    await deps.git.add(options.cwd, [relDir]);
     await deps.git.commit(options.cwd, commitMessage);
     log.success(`Committed: ${commitMessage}`);
-    console.log(chalk14.bold("\n  Plugin installed!\n"));
-    console.log(`  ${pluginName}@${source.version} is committed at ${relTargetDir}/`);
-    console.log("  Push and redeploy to apply its migration and register its routes:");
-    console.log(chalk14.dim(`    git push`));
-    console.log(chalk14.dim(`    biffo deploy <environment> --app-only
-`));
-  } finally {
-    source.cleanup();
   }
+  printNextSteps(names, relDir, channel);
 }
-function parseManifestFile(path) {
-  try {
-    return JSON.parse(readFileSync14(path, "utf8"));
-  } catch (err) {
-    throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
+function printDryRun3(names, relDir, skeletonRoot, channel) {
+  console.log(chalk13.bold("\n  Dry run \u2014 no changes will be made\n"));
+  console.log(`  Plugin:          ${names.slug}`);
+  console.log(`  Channel:         ${channel}`);
+  console.log(`  Would scaffold:  ${relDir}/`);
+  console.log(`  From skeleton:   ${skeletonRoot}`);
+  console.log(`  Python package:  ${names.pkg}   (dist: ${names.dist})`);
+  console.log(`  Would commit:    feat(plugins): scaffold ${names.slug} plugin
+`);
+}
+function printNextSteps(names, relDir, channel) {
+  console.log(chalk13.bold("\n  Plugin scaffolded!\n"));
+  console.log(`  ${relDir}/ contains a working example: one table, four CRUD routes,`);
+  console.log(`  one event subscription, and a terraform/ module for its Lambda.
+`);
+  console.log("  Next:");
+  console.log(chalk13.dim(`    1. Edit ${relDir}/biffo.plugin.json \u2014 your tables and routes`));
+  console.log(chalk13.dim(`    2. Edit ${relDir}/src/${names.pkg}/plugin.py \u2014 your event handlers`));
+  console.log(chalk13.dim(`    3. biffo plugin install --local ${relDir}`));
+  console.log(
+    chalk13.dim("       (copies terraform/ into modules/plugins/, generates the migration)\n")
+  );
+  if (channel === "first-party") {
+    log.warn(
+      `${relDir}/ is template-owned: it will be distributed to every instance by \`biffo core upgrade\`, and bumping core.version is required for it (ADR-0006).`
+    );
   }
 }
-function printDryRun3(entry, source, relTargetDir, inTreeSource) {
-  const name = entry ? entry.name : source.name;
-  const version = entry ? entry.version : source.version;
-  console.log(chalk14.bold("\n  Dry run \u2014 no changes will be made\n"));
-  console.log(`  Plugin:        ${name}@${version}`);
-  if (entry) {
-    console.log(`  Source repo:   ${entry.repo}`);
-    console.log(`  Would clone into:   ${relTargetDir}/`);
-  } else {
-    console.log(`  Local source:  ${source.origin}`);
-    console.log(
-      inTreeSource ? `  Already in tree at ${relTargetDir}/ \u2014 would install in place (no copy)` : `  Would copy into:    ${relTargetDir}/`
-    );
+
+// src/commands/plugin-info.ts
+import chalk14 from "chalk";
+import { Command as Command14 } from "commander";
+
+// src/adapters/registry/index.ts
+import { z as z6 } from "zod";
+var RegistryPluginEntrySchema = z6.object({
+  name: z6.string().regex(/^[a-z][a-z0-9-]*$/),
+  version: z6.string().regex(/^\d+\.\d+\.\d+$/),
+  minor_version: z6.string().regex(/^\d+\.\d+$/),
+  repo: z6.string().url(),
+  description: z6.string().optional(),
+  author: z6.string().optional(),
+  tags: z6.array(z6.string()).optional(),
+  required_core_version: z6.string().optional(),
+  infra_modules: z6.array(z6.string()).optional(),
+  api_routes: z6.array(z6.string()).optional(),
+  ui_components: z6.array(z6.string()).optional(),
+  status: z6.enum(["active", "disabled"])
+});
+var PluginRegistrySchema = z6.object({
+  schema_version: z6.string(),
+  last_updated: z6.string(),
+  plugins: z6.array(RegistryPluginEntrySchema)
+});
+var DEFAULT_REGISTRY_URL = "https://raw.githubusercontent.com/keiranholloway/biffo-plugins-registry/main/plugins.json";
+var RegistryAdapter = class {
+  registryUrl;
+  constructor(registryUrl) {
+    this.registryUrl = registryUrl ?? process.env["BIFFO_REGISTRY_URL"] ?? DEFAULT_REGISTRY_URL;
   }
-  if (!entry || entry.infra_modules && entry.infra_modules.length > 0) {
-    console.log(
-      `  Would copy Terraform module into: modules/plugins/${name}/ (if the plugin has one)`
-    );
-    console.log(
-      `  Would wire module "plugin_${name}" + enabled_plugins into infra/environments/*/plugins.generated.tf and plugins.auto.tfvars.json`
-    );
+  /** Fetches and validates plugins.json from the registry. */
+  async fetchRegistry() {
+    let response;
+    try {
+      response = await fetch(this.registryUrl);
+    } catch (err) {
+      throw new Error(
+        `Could not reach the plugin registry at ${this.registryUrl}: ${err.message}`
+      );
+    }
+    if (!response.ok) {
+      throw new Error(
+        `Plugin registry returned ${response.status} ${response.statusText} (${this.registryUrl})`
+      );
+    }
+    let raw;
+    try {
+      raw = await response.json();
+    } catch (err) {
+      throw new Error(
+        `Plugin registry at ${this.registryUrl} did not return valid JSON: ${err.message}`
+      );
+    }
+    const result = PluginRegistrySchema.safeParse(raw);
+    if (!result.success) {
+      const messages = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+      throw new Error(
+        `Plugin registry at ${this.registryUrl} has an invalid shape: ${messages.join("; ")}`
+      );
+    }
+    return result.data;
   }
-  if (source && source.manifest.tables.length > 0) {
-    console.log(
-      `  Would generate a migration for ${source.manifest.tables.length} table(s) into services/api/migrations/versions/`
-    );
+  /**
+   * Resolves `name@minorVersion` (e.g. "rbac", "1.0") against the registry.
+   *
+   * The registry stores one entry per plugin — its current release — not a
+   * full version history, so "resolving the latest patch for a minor"
+   * degenerates to an exact match against that single entry's
+   * `minor_version`. True multi-version history isn't representable in the
+   * registry schema today; see PR description for this known limitation.
+   */
+  async resolvePlugin(name, minorVersion) {
+    const registry = await this.fetchRegistry();
+    const candidates = registry.plugins.filter((p) => p.name === name);
+    if (candidates.length === 0) {
+      throw new Error(`Plugin '${name}' was not found in the registry (${this.registryUrl}).`);
+    }
+    const match = candidates.find((p) => p.minor_version === minorVersion);
+    if (!match) {
+      const available = candidates.map((p) => `${p.name}@${p.minor_version} (${p.status})`);
+      throw new Error(
+        `No version matching '${name}@${minorVersion}' found in the registry. Available: ${available.join(", ")}`
+      );
+    }
+    if (match.status !== "active") {
+      throw new Error(
+        `Plugin '${name}@${minorVersion}' is disabled in the registry and cannot be installed.`
+      );
+    }
+    return match;
   }
-  console.log(`  Would commit:  feat(plugins): install ${name}@${version}
-`);
-}
+};
 
-// src/commands/plugin-list.ts
-import { existsSync as existsSync18, readFileSync as readFileSync15 } from "fs";
-import { join as join20, resolve as resolve12 } from "path";
-import chalk15 from "chalk";
-import { Command as Command15 } from "commander";
-var pluginListCommand = new Command15("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
-  const cwd = options.cwd ? resolve12(options.cwd) : process.cwd();
+// src/commands/plugin-info.ts
+var pluginInfoCommand = new Command14("info").description("Show registry details for a plugin: biffo plugin info <name>").argument("<name>", "Plugin name").action(async (name) => {
   try {
-    await runPluginList({ cwd });
+    await runPluginInfo(name, { registry: new RegistryAdapter() });
   } catch (err) {
     log.error(err.message);
     process.exit(1);
   }
 });
-async function runPluginList(options) {
-  const servicesDir = join20(options.cwd, "services");
-  if (!existsSync18(servicesDir)) {
-    throw new Error(
-      `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
-    );
-  }
-  const plugins = [];
-  for (const location of findInstalledPlugins(options.cwd)) {
-    try {
-      const manifest = validateManifest(JSON.parse(readFileSync15(location.manifestPath, "utf8")));
-      plugins.push({
-        name: manifest.name,
-        version: manifest.version,
-        location: location.relDir
-      });
-    } catch (err) {
-      log.warn(
-        `Skipping ${location.relDir}/biffo.plugin.json \u2014 invalid manifest: ${err.message}`
-      );
-    }
+async function runPluginInfo(name, deps) {
+  const registry = await deps.registry.fetchRegistry();
+  const matches = registry.plugins.filter((p) => p.name === name);
+  if (matches.length === 0) {
+    throw new Error(`Plugin '${name}' was not found in the registry.`);
   }
-  if (plugins.length === 0) {
-    console.log(chalk15.dim("\n  No plugins installed in this checkout.\n"));
-    return;
+  for (const entry of matches) {
+    printEntry(entry);
   }
-  const nameWidth = Math.max(...plugins.map((p) => p.name.length), "NAME".length);
-  const versionWidth = Math.max(...plugins.map((p) => p.version.length), "VERSION".length);
-  console.log(chalk15.bold(`
-  Installed plugins (${plugins.length})
+}
+function printEntry(entry) {
+  console.log(chalk14.bold(`
+  ${entry.name}@${entry.version}
 `));
-  console.log(`  ${"NAME".padEnd(nameWidth)}  ${"VERSION".padEnd(versionWidth)}  LOCATION`);
-  for (const plugin of plugins) {
-    console.log(
-      `  ${plugin.name.padEnd(nameWidth)}  ${plugin.version.padEnd(versionWidth)}  ${plugin.location}`
-    );
+  console.log(`  Status:                 ${entry.status}`);
+  console.log(`  Minor version channel:  ${entry.minor_version}`);
+  console.log(`  Repo:                   ${entry.repo}`);
+  if (entry.description) console.log(`  Description:            ${entry.description}`);
+  if (entry.author) console.log(`  Author:                 ${entry.author}`);
+  if (entry.tags?.length) console.log(`  Tags:                   ${entry.tags.join(", ")}`);
+  if (entry.required_core_version) {
+    console.log(`  Required core version:  ${entry.required_core_version}`);
   }
-  console.log(
-    chalk15.dim(
-      `
-  Note: no "status" / "last-updated" columns \u2014 the CLI tracks no installed-plugin registry locally. Once pushed and deployed, live status is available from the running Core API's GET /admin/plugins/available.
-`
-    )
-  );
+  if (entry.infra_modules?.length) {
+    console.log(`  Infra modules:          ${entry.infra_modules.join(", ")}`);
+  }
+  if (entry.api_routes?.length) {
+    console.log(`  API routes:             ${entry.api_routes.join(", ")}`);
+  }
+  if (entry.ui_components?.length) {
+    console.log(`  UI components:          ${entry.ui_components.join(", ")}`);
+  }
+  console.log("");
 }
 
-// src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync19 } from "fs";
-import { join as join21, relative as relative4, resolve as resolve13 } from "path";
-import chalk16 from "chalk";
-import { Command as Command16 } from "commander";
-var pluginSyncMigrationsCommand = new Command16("sync-migrations").description(
-  "Generate real, committed migration file(s) for installed-but-not-yet-migrated plugin(s): biffo plugin sync-migrations [name]"
-).argument("[name]", "Restrict to this installed plugin (default: every plugin under services/)").option("--dry-run", "Generate nothing; just report what would be generated").option("--no-commit", "Generate and stage the file(s) but do not commit").option("--cwd <path>", "Project root (defaults to the current directory)").action(
-  async (name, options) => {
-    const cwd = options.cwd ? resolve13(options.cwd) : process.cwd();
+// src/commands/plugin-install.ts
+import { cpSync as cpSync3, existsSync as existsSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync16, statSync as statSync5 } from "fs";
+import { basename, join as join21, relative as relative3, resolve as resolve12 } from "path";
+import chalk15 from "chalk";
+import { Command as Command15 } from "commander";
+
+// src/adapters/plugin-migrations/index.ts
+import { execa as execa3 } from "execa";
+import { join as join19 } from "path";
+var PluginMigrationsAdapter = class {
+  /**
+   * Generates migration file(s) for `pluginNames` (every discovered
+   * installed plugin if omitted), returning the absolute path of each newly
+   * generated file — empty if every named plugin already had a migration,
+   * or declared no tables.
+   */
+  async generate(cwd, pluginNames) {
+    const scriptPath = join19(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
+    const args = [
+      "run",
+      "python",
+      scriptPath,
+      "--services-root",
+      join19(cwd, "services"),
+      "--versions-dir",
+      join19(cwd, "services", "api", "migrations", "versions")
+    ];
+    for (const name of pluginNames ?? []) {
+      args.push("--plugin", name);
+    }
+    let result;
     try {
-      await runPluginSyncMigrations(
-        name,
-        { dryRun: options.dryRun ?? false, commit: options.commit, cwd },
-        { migrations: new PluginMigrationsAdapter(), git: new GitAdapter() }
-      );
+      result = await execa3("uv", args, { cwd: join19(cwd, "services", "api") });
     } catch (err) {
-      log.error(err.message);
-      process.exit(1);
+      const cause = err;
+      if (cause.code === "ENOENT") {
+        throw new Error(
+          "biffo plugin install/upgrade/sync-migrations needs `uv` (Python) on PATH to generate a real migration file \u2014 see https://docs.astral.sh/uv/ to install it. Once installed, re-run this command (or `biffo plugin sync-migrations <name>` if services/<name>/ is already copied in)."
+        );
+      }
+      throw new Error(
+        `Failed to generate plugin migration: ${cause.stderr?.trim() || err.message}`
+      );
     }
+    return result.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
   }
-);
-async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join21(options.cwd, "services");
-  if (!existsSync19(servicesDir)) {
-    throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
+};
+
+// src/lib/plugin-terraform-wiring.ts
+import { existsSync as existsSync18, mkdirSync as mkdirSync8, readFileSync as readFileSync15, readdirSync as readdirSync10, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
+import { join as join20 } from "path";
+var TEMPLATE_MODULE_DIR = "_template";
+var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
+var GENERATED_TF_FILE = "plugins.generated.tf";
+var GENERATED_TFVARS_FILE = "plugins.auto.tfvars.json";
+function standardArguments(pluginName, handler) {
+  return [
+    ["project_name", "var.project_name"],
+    ["environment", "local.environment"],
+    ["plugin_name", JSON.stringify(pluginName)],
+    ["handler", JSON.stringify(handler)],
+    ["event_bus_name", "module.events.event_bus_name"],
+    ["core_api_url", "module.api_gateway.api_endpoint"],
+    ["core_api_execution_arn", "module.api_gateway.execution_arn"],
+    ["tags", "local.tags"]
+  ];
+}
+function listPluginModules(cwd) {
+  const dir = join20(cwd, "modules", "plugins");
+  let entries;
+  try {
+    entries = readdirSync10(dir, { withFileTypes: true });
+  } catch {
+    return [];
   }
-  if (name && !existsSync19(join21(servicesDir, name, "biffo.plugin.json"))) {
-    throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
+  return entries.filter((e) => e.isDirectory() && e.name !== TEMPLATE_MODULE_DIR && !e.name.startsWith(".")).map((e) => e.name).sort();
+}
+function listEnvironments(cwd) {
+  const dir = join20(cwd, "infra", "environments");
+  let entries;
+  try {
+    entries = readdirSync10(dir, { withFileTypes: true });
+  } catch {
+    return [];
   }
-  if (options.dryRun) {
-    console.log(chalk16.bold("\n  Dry run \u2014 no changes will be made\n"));
-    console.log(`  Target: ${name ?? "all installed plugins under services/"}
-`);
-    return;
+  return entries.filter((e) => {
+    if (!e.isDirectory() || !existsSync18(join20(dir, e.name, "main.tf"))) return false;
+    return declaredVariables(join20(dir, e.name)).has("enabled_plugins");
+  }).map((e) => e.name).sort();
+}
+function listUnwirableEnvironments(cwd) {
+  const dir = join20(cwd, "infra", "environments");
+  let entries;
+  try {
+    entries = readdirSync10(dir, { withFileTypes: true });
+  } catch {
+    return [];
   }
-  const generated = await deps.migrations.generate(options.cwd, name ? [name] : void 0);
-  if (generated.length === 0) {
-    log.warn(
-      name ? `${name} already has a committed migration (or declares no tables) \u2014 nothing to do.` : "Every installed plugin already has a committed migration (or declares no tables) \u2014 nothing to do."
-    );
-    return;
+  return entries.filter(
+    (e) => e.isDirectory() && existsSync18(join20(dir, e.name, "main.tf")) && !declaredVariables(join20(dir, e.name)).has("enabled_plugins")
+  ).map((e) => e.name).sort();
+}
+function declaredVariables(moduleDir) {
+  const names = /* @__PURE__ */ new Set();
+  let entries;
+  try {
+    entries = readdirSync10(moduleDir, { withFileTypes: true });
+  } catch {
+    return names;
   }
-  const relativePaths = generated.map((p) => relative4(options.cwd, p));
-  for (const p of relativePaths) {
-    log.success(`Generated ${p}`);
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
+    let contents;
+    try {
+      contents = readFileSync15(join20(moduleDir, entry.name), "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of contents.matchAll(/^\s*variable\s+"([^"]+)"/gm)) {
+      names.add(match[1]);
+    }
   }
-  if (options.commit) {
-    const isRepo = await deps.git.isGitRepo(options.cwd);
-    if (!isRepo) {
-      throw new Error(`${options.cwd} is not a git repository \u2014 cannot commit.`);
+  return names;
+}
+function renderArguments(args, indent) {
+  const width = Math.max(...args.map(([key]) => key.length));
+  return args.map(([key, value]) => `${indent}${key.padEnd(width)} = ${value}`).join("\n");
+}
+function renderModuleBlock(pluginName, declared, handler) {
+  const args = standardArguments(pluginName, handler).filter(([key]) => declared.has(key));
+  const quoted = JSON.stringify(pluginName);
+  return [
+    `module "plugin_${pluginName}" {`,
+    `  source   = "../../../modules/plugins/${pluginName}"`,
+    `  for_each = contains(var.enabled_plugins, ${quoted}) ? { ${quoted} = true } : {}`,
+    "",
+    renderArguments(args, "  "),
+    "}",
+    "",
+    `output "plugin_${pluginName}_function_arn" {`,
+    `  description = "Lambda ARN of the ${pluginName} plugin, or null when it is not in enabled_plugins."`,
+    `  value       = try(module.plugin_${pluginName}[${quoted}].function_arn, null)`,
+    "}"
+  ].join("\n");
+}
+var GENERATED_HEADER = `# ---------------------------------------------------------------------------
+# GENERATED FILE \u2014 DO NOT EDIT BY HAND.
+#
+# Written by \`biffo plugin install\` / \`biffo plugin uninstall\` (issue #201),
+# regenerated in full from the contents of modules/plugins/. Any manual edit is
+# lost on the next plugin install or uninstall.
+#
+# Terraform loads every *.tf file in this directory, so these blocks are as
+# live as anything in main.tf \u2014 they simply live in a CLI-owned file so the
+# CLI never has to rewrite your hand-authored main.tf.
+#
+# Terraform requires a module's \`source\` to be a static string literal, so it
+# cannot loop over var.enabled_plugins; hence one explicit block per plugin,
+# each gated on membership in enabled_plugins (supplied by the generated
+# ${GENERATED_TFVARS_FILE} alongside this file).
+#
+# Not generated here: the Core API's BIFFO_SERVICE_PRINCIPAL_ARN_ALLOWLIST
+# (ADR-0009). It lives in main.tf and is derived from var.enabled_plugins as a
+# static role-name glob \u2014 deriving it from a plugin module's role_arn output
+# would create the cycle core_api -> api_gateway -> plugin -> core_api.
+# ---------------------------------------------------------------------------
+`;
+function renderGeneratedTerraform(plugins) {
+  const blocks = plugins.map(
+    (p) => renderModuleBlock(p.name, p.declaredVariables, p.handler ?? DEFAULT_PLUGIN_HANDLER)
+  );
+  return `${GENERATED_HEADER}
+${blocks.join("\n\n")}
+`;
+}
+function renderGeneratedTfvars(pluginNames) {
+  return `${JSON.stringify({ enabled_plugins: pluginNames }, null, 2)}
+`;
+}
+function syncPluginTerraform(cwd) {
+  const plugins = listPluginModules(cwd);
+  const environments = listEnvironments(cwd);
+  const skippedEnvironments = listUnwirableEnvironments(cwd);
+  const changedPaths = [];
+  const rendered = plugins.map((name) => ({
+    name,
+    declaredVariables: declaredVariables(join20(cwd, "modules", "plugins", name))
+  }));
+  for (const env of environments) {
+    const envDir = join20(cwd, "infra", "environments", env);
+    const tfPath = join20(envDir, GENERATED_TF_FILE);
+    const tfvarsPath = join20(envDir, GENERATED_TFVARS_FILE);
+    const relBase = `infra/environments/${env}`;
+    if (plugins.length === 0) {
+      for (const [abs, rel] of [
+        [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
+        [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
+      ]) {
+        if (existsSync18(abs)) {
+          rmSync6(abs);
+          changedPaths.push(rel);
+        }
+      }
+      continue;
     }
-    await deps.git.add(options.cwd, relativePaths);
-    const label = name ?? `${String(generated.length)} plugin(s)`;
-    const commitMessage = `chore(plugins): sync migration(s) for ${label}`;
-    await deps.git.commit(options.cwd, commitMessage);
-    log.success(`Committed: ${commitMessage}`);
-  } else {
-    log.warn("--no-commit: generated file(s) are on disk but not staged/committed.");
+    mkdirSync8(envDir, { recursive: true });
+    writeFileSync8(tfPath, renderGeneratedTerraform(rendered));
+    writeFileSync8(tfvarsPath, renderGeneratedTfvars(plugins));
+    changedPaths.push(`${relBase}/${GENERATED_TF_FILE}`, `${relBase}/${GENERATED_TFVARS_FILE}`);
   }
+  return { plugins, environments, skippedEnvironments, changedPaths };
 }
 
-// src/commands/plugin-uninstall.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16, rmSync as rmSync6 } from "fs";
-import { join as join22, resolve as resolve14 } from "path";
-import chalk17 from "chalk";
-import { Command as Command17 } from "commander";
-import inquirer6 from "inquirer";
-var NAME_PATTERN2 = /^[a-z][a-z0-9-]*$/;
-var pluginUninstallCommand = new Command17("uninstall").description("Remove an installed plugin: biffo plugin uninstall <name>").argument("<name>", "Plugin name").option("--dry-run", "Print planned changes without modifying the repo").option("--force", "Skip the confirmation prompt").option(
-  "--keep-data",
-  "No-op today (see notes) \u2014 the CLI never drops plugin data regardless of this flag"
-).option("--cwd <path>", "Project root to uninstall from (defaults to the current directory)").action(
-  async (name, options) => {
-    const cwd = options.cwd ? resolve14(options.cwd) : process.cwd();
+// src/commands/plugin-install.ts
+var TARGET_PATTERN = /^([a-z][a-z0-9-]*)@(\d+\.\d+)$/;
+var pluginInstallCommand = new Command15("install").description(
+  "Install a plugin from the Biffo plugin registry (biffo plugin install <name>@<minor>) or from a local directory (biffo plugin install --local <path>)"
+).argument("[target]", "Plugin name and minor version, e.g. rbac@1.0 (omit when using --local)").option(
+  "--local <path>",
+  "Install from a local, unpublished plugin directory instead of the registry"
+).option("--dry-run", "Resolve the plugin and print planned changes without modifying the repo").option("--cwd <path>", "Project root to install into (defaults to the current directory)").action(
+  async (target, options) => {
+    const cwd = options.cwd ? resolve12(options.cwd) : process.cwd();
     try {
-      await runPluginUninstall(
-        name,
+      await runPluginInstall(
+        target,
         {
+          ...options.local ? { local: resolve12(options.local) } : {},
           dryRun: options.dryRun ?? false,
-          force: options.force ?? false,
-          keepData: options.keepData ?? false,
           cwd
         },
-        { git: new GitAdapter() }
+        {
+          registry: new RegistryAdapter(),
+          git: new GitAdapter(),
+          migrations: new PluginMigrationsAdapter()
+        }
       );
     } catch (err) {
       log.error(err.message);
@@ -4961,889 +5366,670 @@ var pluginUninstallCommand = new Command17("uninstall").description("Remove an i
     }
   }
 );
-async function runPluginUninstall(name, options, deps) {
-  if (!NAME_PATTERN2.test(name)) {
-    throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
-  }
-  const servicesDir = join22(options.cwd, "services");
-  if (!existsSync20(servicesDir)) {
-    throw new Error(
-      `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
-    );
-  }
-  const targetDir = join22(servicesDir, name);
-  if (!existsSync20(targetDir)) {
-    const firstParty = join22(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync20(firstParty)) {
-      throw new Error(
-        `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
-      );
-    }
-    throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
-  }
-  const version = readInstalledVersion(targetDir);
-  const modulesDir = join22(options.cwd, "modules", "plugins", name);
-  const stagePaths = [`services/${name}`];
-  if (existsSync20(modulesDir)) {
-    stagePaths.push(`modules/plugins/${name}`);
-  }
-  if (options.dryRun) {
-    printDryRun4(name, version, stagePaths, options.keepData);
-    return;
+var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
+  ".git",
+  ".venv",
+  "node_modules",
+  "__pycache__",
+  ".ruff_cache",
+  ".pytest_cache",
+  ".mypy_cache",
+  "dist",
+  ".terraform"
+]);
+function resolveLocalPlugin(localPath) {
+  if (!existsSync19(localPath)) {
+    throw new Error(`--local path does not exist: ${localPath}`);
   }
-  if (!options.force) {
-    const proceed = await confirmUninstall(name, version);
-    if (!proceed) {
-      log.warn("Uninstall cancelled");
-      return;
-    }
+  if (!statSync5(localPath).isDirectory()) {
+    throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const isRepo = await deps.git.isGitRepo(options.cwd);
-  if (!isRepo) {
+  const manifestPath = join21(localPath, "biffo.plugin.json");
+  if (!existsSync19(manifestPath)) {
     throw new Error(
-      `${options.cwd} is not a git repository \u2014 biffo plugin uninstall must be run from a Biffo project checkout.`
-    );
-  }
-  rmSync6(targetDir, { recursive: true, force: true });
-  log.success(`Removed services/${name}/`);
-  if (existsSync20(modulesDir)) {
-    rmSync6(modulesDir, { recursive: true, force: true });
-    log.success(`Removed modules/plugins/${name}/`);
-    const wiring = syncPluginTerraform(options.cwd);
-    stagePaths.push(...wiring.changedPaths);
-    if (wiring.changedPaths.length > 0) {
-      log.success(
-        `Unwired module "plugin_${name}" and its enabled_plugins entry from ${wiring.environments.length} environment(s): ${wiring.environments.join(", ")}`
-      );
-    }
-  }
-  const label = version ? `${name}@${version}` : name;
-  const commitMessage = `chore(plugins): uninstall ${label}`;
-  await deps.git.add(options.cwd, stagePaths);
-  await deps.git.commit(options.cwd, commitMessage);
-  log.success(`Committed: ${commitMessage}`);
-  console.log(chalk17.bold("\n  Plugin uninstalled!\n"));
-  console.log(`  services/${name}/ has been removed and committed.`);
-  console.log(
-    "  Push and redeploy so the Core API stops discovering its routes at the next db-init:"
-  );
-  console.log(chalk17.dim(`    git push`));
-  console.log(chalk17.dim(`    biffo deploy <environment> --app-only
-`));
-  if (options.keepData) {
-    console.log(
-      chalk17.dim(
-        "  --keep-data: no action was needed \u2014 the CLI never drops plugin tables. See notes.\n"
-      )
-    );
-  } else {
-    log.warn(
-      "Any tables this plugin created remain in the database, and its migration file at services/api/migrations/versions/ is NOT removed (it is a permanent historical record \u2014 see notes). Dropping tables, if desired, requires a manual Alembic migration written against the Core API."
+      `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
   }
-}
-function readInstalledVersion(targetDir) {
-  const manifestPath = join22(targetDir, "biffo.plugin.json");
-  if (!existsSync20(manifestPath)) return void 0;
-  try {
-    return validateManifest(JSON.parse(readFileSync16(manifestPath, "utf8"))).version;
-  } catch {
-    return void 0;
-  }
-}
-async function confirmUninstall(name, version) {
-  const label = version ? `${name}@${version}` : name;
-  const { confirmed } = await inquirer6.prompt([
-    {
-      type: "confirm",
-      name: "confirmed",
-      message: `Remove ${chalk17.bold(label)} from services/${name}/? This cannot be undone from the CLI.`,
-      default: false
+  const manifest = validateManifest(parseManifestFile(manifestPath));
+  return {
+    name: manifest.name,
+    version: manifest.version,
+    manifest,
+    sourceDir: localPath,
+    origin: localPath,
+    cleanup: () => {
     }
-  ]);
-  return confirmed;
+  };
 }
-function printDryRun4(name, version, stagePaths, keepData) {
-  const label = version ? `${name}@${version}` : name;
-  console.log(chalk17.bold("\n  Dry run \u2014 no changes will be made\n"));
-  console.log(`  Plugin:        ${label}`);
-  console.log(`  Would remove:  ${stagePaths.join(", ")}`);
-  console.log(
-    `  Would unwire:  module "plugin_${name}" + its enabled_plugins entry from infra/environments/*/plugins.generated.tf`
-  );
-  console.log(`  Would commit:  chore(plugins): uninstall ${label}`);
-  console.log(
-    `  --keep-data:   ${keepData ? "no-op \u2014 CLI never drops tables either way" : "not set \u2014 no DB action taken either way; see notes"}
-`
-  );
+function parsePluginTarget(target) {
+  const match = TARGET_PATTERN.exec(target);
+  if (!match) {
+    throw new Error(`Invalid target '${target}'. Expected format: <name>@<minor>, e.g. rbac@1.0`);
+  }
+  return { name: match[1], minor: match[2] };
 }
-
-// src/commands/plugin-upgrade.ts
-import { cpSync as cpSync3, existsSync as existsSync21, mkdirSync as mkdirSync8, readFileSync as readFileSync17, rmSync as rmSync7 } from "fs";
-import { join as join23, relative as relative5, resolve as resolve15 } from "path";
-import chalk18 from "chalk";
-import { Command as Command18 } from "commander";
-import inquirer7 from "inquirer";
-var pluginUpgradeCommand = new Command18("upgrade").description(
-  "Upgrade an installed plugin to a new minor version: biffo plugin upgrade <name>@<new-minor>"
-).argument("<target>", "Plugin name and new minor version, e.g. rbac@1.1").option("--dry-run", "Resolve the new version and print planned changes without applying them").option("--force", "Skip the confirmation prompt").option("--cwd <path>", "Project root to upgrade in (defaults to the current directory)").action(async (target, options) => {
-  const cwd = options.cwd ? resolve15(options.cwd) : process.cwd();
+async function cloneAndValidatePlugin(entry, git) {
+  const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    await runPluginUpgrade(
-      target,
-      { dryRun: options.dryRun ?? false, force: options.force ?? false, cwd },
-      {
-        registry: new RegistryAdapter(),
-        git: new GitAdapter(),
-        migrations: new PluginMigrationsAdapter()
-      }
-    );
+    const manifestPath = join21(tmpDir, "biffo.plugin.json");
+    if (!existsSync19(manifestPath)) {
+      throw new Error(
+        `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
+      );
+    }
+    const manifest = validateManifest(parseManifestFile(manifestPath));
+    if (manifest.name !== entry.name) {
+      throw new Error(
+        `Manifest name '${manifest.name}' in ${entry.repo} does not match the registry entry '${entry.name}'.`
+      );
+    }
+    return { tmpDir, manifest };
   } catch (err) {
-    log.error(err.message);
-    process.exit(1);
+    git.cleanup(tmpDir);
+    throw err;
   }
-});
-async function runPluginUpgrade(target, options, deps) {
-  const { name, minor } = parsePluginTarget(target);
-  const servicesDir = join23(options.cwd, "services");
-  if (!existsSync21(servicesDir)) {
+}
+async function runPluginInstall(target, options, deps) {
+  if (options.local && target) {
     throw new Error(
-      `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
+      `Pass either a registry target (<name>@<minor>) or --local <path>, not both. --local installs an unpublished plugin from disk and has no registry entry to resolve.`
     );
   }
-  const targetDir = join23(servicesDir, name);
-  if (!existsSync21(targetDir)) {
+  if (!options.local && !target) {
     throw new Error(
-      `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
+      `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const currentVersion = readInstalledVersion2(targetDir);
-  log.info(`Resolving ${name}@${minor} from the plugin registry...`);
-  const entry = await deps.registry.resolvePlugin(name, minor);
-  log.success(`Resolved ${entry.name}@${entry.version} \u2014 ${entry.repo}`);
-  if (entry.required_core_version) {
-    log.warn(
-      `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
+  const servicesDir = join21(options.cwd, "services");
+  if (!existsSync19(servicesDir)) {
+    throw new Error(
+      `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const modulesDir = join23(options.cwd, "modules", "plugins", entry.name);
-  if (options.dryRun) {
-    printDryRun5(entry, currentVersion);
-    return;
+  let source;
+  let entry = null;
+  if (options.local) {
+    source = resolveLocalPlugin(options.local);
+    log.success(`Resolved ${source.name}@${source.version} from ${source.origin}`);
+  } else {
+    const { name, minor } = parsePluginTarget(target);
+    log.info(`Resolving ${name}@${minor} from the plugin registry...`);
+    entry = await deps.registry.resolvePlugin(name, minor);
+    log.success(`Resolved ${entry.name}@${entry.version} \u2014 ${entry.repo}`);
   }
-  if (currentVersion === entry.version) {
-    log.warn(`services/${name}/ is already at ${entry.version} \u2014 nothing to upgrade.`);
-    return;
+  const pluginName = entry ? entry.name : source.name;
+  const relTargetDir = pluginDir(pluginName, "third-party");
+  const targetDir = join21(options.cwd, relTargetDir);
+  const modulesDir = join21(options.cwd, "modules", "plugins", pluginName);
+  const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
+  if (existsSync19(targetDir) && !inTreeSource) {
+    throw new Error(
+      `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
+    );
   }
-  if (!options.force) {
-    const proceed = await confirmUpgrade(name, currentVersion, entry.version);
-    if (!proceed) {
-      log.warn("Upgrade cancelled");
-      return;
-    }
+  if (options.dryRun) {
+    printDryRun4(entry, source, relTargetDir, inTreeSource);
+    return;
   }
   const isRepo = await deps.git.isGitRepo(options.cwd);
   if (!isRepo) {
     throw new Error(
-      `${options.cwd} is not a git repository \u2014 biffo plugin upgrade must be run from a Biffo project checkout.`
+      `${options.cwd} is not a git repository \u2014 biffo plugin install must be run from a Biffo project checkout.`
     );
   }
-  log.info(`Cloning ${entry.repo}...`);
-  const { tmpDir, manifest } = await cloneAndValidatePlugin(entry, deps.git);
+  if (entry) {
+    log.info(`Cloning ${entry.repo}...`);
+    const cloned = await cloneAndValidatePlugin(entry, deps.git);
+    source = {
+      name: entry.name,
+      version: entry.version,
+      manifest: cloned.manifest,
+      sourceDir: cloned.tmpDir,
+      origin: entry.repo,
+      cleanup: () => deps.git.cleanup(cloned.tmpDir)
+    };
+  }
+  const { manifest } = source;
   try {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
-    rmSync7(targetDir, { recursive: true, force: true });
-    mkdirSync8(targetDir, { recursive: true });
-    cpSync3(tmpDir, targetDir, { recursive: true });
-    log.success(`Upgraded plugin source at services/${entry.name}/`);
-    const stagePaths = [`services/${entry.name}`];
-    if (existsSync21(modulesDir)) {
-      rmSync7(modulesDir, { recursive: true, force: true });
+    if (inTreeSource) {
+      log.info(`${relTargetDir}/ is already in this checkout \u2014 installing in place.`);
+    } else {
+      mkdirSync9(targetDir, { recursive: true });
+      cpSync3(source.sourceDir, targetDir, {
+        recursive: true,
+        filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename(src))
+      });
+      log.success(`Installed plugin source at ${relTargetDir}/`);
     }
-    const tfSourceDir = join23(targetDir, "terraform");
-    if (existsSync21(tfSourceDir)) {
-      mkdirSync8(modulesDir, { recursive: true });
+    const stagePaths = [relTargetDir];
+    const tfSourceDir = join21(targetDir, "terraform");
+    if (existsSync19(tfSourceDir)) {
+      mkdirSync9(modulesDir, { recursive: true });
       cpSync3(tfSourceDir, modulesDir, { recursive: true });
-      stagePaths.push(`modules/plugins/${entry.name}`);
-      log.success(`Copied Terraform module to modules/plugins/${entry.name}/`);
-    }
-    if (manifest.tables.length > 0) {
-      log.info(
-        `Generating migration for services/${entry.name}/'s ${manifest.tables.length} table(s)...`
-      );
-      const generatedPaths = await deps.migrations.generate(options.cwd, [entry.name]);
-      for (const absPath of generatedPaths) {
-        stagePaths.push(relative5(options.cwd, absPath));
-      }
-      if (generatedPaths.length > 0) {
-        log.success(`Generated migration: ${relative5(options.cwd, generatedPaths[0])}`);
-      }
-    }
-    const label = currentVersion ? `${entry.name} ${currentVersion} -> ${entry.version}` : `${entry.name} to ${entry.version}`;
-    const commitMessage = `feat(plugins): upgrade ${label}`;
-    await deps.git.add(options.cwd, stagePaths);
-    await deps.git.commit(options.cwd, commitMessage);
-    log.success(`Committed: ${commitMessage}`);
-    console.log(chalk18.bold("\n  Plugin upgraded!\n"));
-    console.log(`  ${entry.name}@${entry.version} is committed at services/${entry.name}/`);
-    console.log("  Push and redeploy to apply its updated tables and routes:");
-    console.log(chalk18.dim(`    git push`));
-    console.log(chalk18.dim(`    biffo deploy <environment> --app-only
-`));
-  } finally {
-    deps.git.cleanup(tmpDir);
-  }
-}
-function readInstalledVersion2(targetDir) {
-  const manifestPath = join23(targetDir, "biffo.plugin.json");
-  if (!existsSync21(manifestPath)) return void 0;
-  try {
-    return validateManifest(JSON.parse(readFileSync17(manifestPath, "utf8"))).version;
-  } catch {
-    return void 0;
-  }
-}
-async function confirmUpgrade(name, currentVersion, newVersion) {
-  const message = currentVersion ? `Upgrade ${chalk18.bold(name)} from ${currentVersion} to ${chalk18.bold(newVersion)}?` : `Upgrade ${chalk18.bold(name)} to ${chalk18.bold(newVersion)}?`;
-  const { confirmed } = await inquirer7.prompt([
-    { type: "confirm", name: "confirmed", message, default: false }
-  ]);
-  return confirmed;
-}
-function printDryRun5(entry, currentVersion) {
-  console.log(chalk18.bold("\n  Dry run \u2014 no changes will be made\n"));
-  console.log(`  Plugin:        ${entry.name}`);
-  console.log(`  Current:       ${currentVersion ?? "(unknown \u2014 manifest unreadable)"}`);
-  console.log(`  Would upgrade to: ${entry.version}`);
-  console.log(`  Source repo:   ${entry.repo}`);
-  console.log(`  Would replace: services/${entry.name}/`);
-  if (entry.infra_modules && entry.infra_modules.length > 0) {
-    console.log(
-      `  Would replace Terraform module at: modules/plugins/${entry.name}/ (if the repo has one)`
-    );
-  }
-  console.log(`  Would commit:  feat(plugins): upgrade ${entry.name} to ${entry.version}
-`);
-}
-
-// src/commands/plugin.ts
-var pluginCommand = new Command19("plugin").description("Manage Biffo plugins");
-pluginCommand.addCommand(pluginCreateCommand);
-pluginCommand.addCommand(pluginListCommand);
-pluginCommand.addCommand(pluginInstallCommand);
-pluginCommand.addCommand(pluginUninstallCommand);
-pluginCommand.addCommand(pluginUpgradeCommand);
-pluginCommand.addCommand(pluginSyncMigrationsCommand);
-pluginCommand.addCommand(pluginInfoCommand);
-
-// src/commands/sibling.ts
-import { Command as Command21 } from "commander";
-
-// src/commands/sibling-create.ts
-import { cpSync as cpSync4, existsSync as existsSync23, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync4, readFileSync as readFileSync19, writeFileSync as writeFileSync8 } from "fs";
-import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname8, join as join25, resolve as resolve16 } from "path";
-import chalk19 from "chalk";
-import { Command as Command20 } from "commander";
-
-// src/config/sibling-schema.ts
-import { z as z6 } from "zod";
-var SiblingConfigSchema = z6.object({
-  $schema: z6.string().optional(),
-  project: z6.object({
-    name: z6.string().min(1).regex(
-      /^[a-z][a-z0-9-]*$/,
-      "Must be lowercase kebab-case, starting with a letter (it becomes a URL path segment)"
-    ),
-    description: z6.string().default(""),
-    // Notable routes this sibling exposes, shown as labelled links on the
-    // core project's Microservices tab (ADR-0007). Each `path` is relative to
-    // the sibling's own path_prefix (so "demo" renders as /<prefix>/demo), and
-    // `label` is the human name. Empty by default — a sibling with no declared
-    // routes just shows its single root link. Declare real routes here as you
-    // build the sibling's pages; the values flow to the core's
-    // siblings.auto.tfvars.json at registration and into siblings.json at deploy.
-    routes: z6.array(
-      z6.object({
-        path: z6.string().min(1).regex(
-          /^[a-z0-9][a-z0-9/-]*$/,
-          'Sub-path relative to the sibling prefix, no leading slash (e.g. "demo" or "apply")'
-        ),
-        label: z6.string().min(1)
-      })
-    ).default([])
-  }),
-  source_control: SourceControlConfigSchema,
-  cloud: CloudConfigSchema,
-  environments: z6.array(z6.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
-  // The core project this sibling is paired with (ADR-0007) — never
-  // provisions its own Cognito pool or CloudFront distribution, always
-  // plugs into the core project's.
-  core: z6.object({
-    // Exactly one of these two must be set — see the superRefine below.
-    project_name: z6.string().min(1).optional().describe("Name of a project previously scaffolded with `biffo init` on this machine"),
-    config_path: z6.string().min(1).optional().describe(
-      "Path to the core project's biffo.config.json, for when it wasn't scaffolded here"
-    ),
-    // Defaults to project.name at parse time by the caller (sibling-create.ts),
-    // not here — z.object() has no access to sibling fields from within core's
-    // own schema without restructuring the whole object, and the caller
-    // already has both values in hand when it validates.
-    path_prefix: z6.string().min(1).regex(/^[a-z][a-z0-9-]*$/, "Must be lowercase kebab-case").optional()
-  })
-}).superRefine((config, ctx) => {
-  if (!config.core.project_name && !config.core.config_path) {
-    ctx.addIssue({
-      code: z6.ZodIssueCode.custom,
-      path: ["core"],
-      message: "Either core.project_name or core.config_path is required"
-    });
+      stagePaths.push(`modules/plugins/${pluginName}`);
+      log.success(`Copied Terraform module to modules/plugins/${pluginName}/`);
+      const wiring = syncPluginTerraform(options.cwd);
+      stagePaths.push(...wiring.changedPaths);
+      if (wiring.environments.length > 0) {
+        log.success(
+          `Wired module "plugin_${pluginName}" and enabled_plugins into ${wiring.environments.length} environment(s): ${wiring.environments.join(", ")}`
+        );
+        log.info(
+          "The Core API allowlist (ADR-0009) follows automatically \u2014 local.plugin_service_principal_arns in main.tf derives it from enabled_plugins."
+        );
+      } else {
+        log.warn(
+          "No wirable infra/environments/*/ root config found, so the Terraform module was copied but not wired into any environment."
+        );
+      }
+      if (wiring.skippedEnvironments.length > 0) {
+        log.warn(
+          `Skipped ${wiring.skippedEnvironments.join(", ")} \u2014 no \`enabled_plugins\` variable declared there. infra/ is user-owned, so \`biffo core upgrade\` cannot add it: copy the variable (and local.plugin_service_principal_arns) from the template\u2019s infra/environments/dev/ and re-run this install to wire those environments.`
+        );
+      }
+    } else if (manifest.event_subscriptions.length > 0) {
+      log.warn(
+        `Plugin "${pluginName}" declares ${manifest.event_subscriptions.length} event subscription(s) but ships no terraform/ directory, so no Lambda or EventBridge rule was created \u2014 those events will never reach it. Add a terraform/ module (start from modules/plugins/_template/) and reinstall.`
+      );
+    }
+    if (manifest.tables.length > 0) {
+      log.info(`Generating migration for ${relTargetDir}/'s ${manifest.tables.length} table(s)...`);
+      const generatedPaths = await deps.migrations.generate(options.cwd, [pluginName]);
+      for (const absPath of generatedPaths) {
+        stagePaths.push(relative3(options.cwd, absPath));
+      }
+      if (generatedPaths.length > 0) {
+        log.success(`Generated migration: ${relative3(options.cwd, generatedPaths[0])}`);
+      }
+    } else {
+      log.info(`${pluginName} declares no tables \u2014 nothing to migrate.`);
+    }
+    const commitMessage = `feat(plugins): install ${pluginName}@${source.version}`;
+    await deps.git.add(options.cwd, stagePaths);
+    await deps.git.commit(options.cwd, commitMessage);
+    log.success(`Committed: ${commitMessage}`);
+    console.log(chalk15.bold("\n  Plugin installed!\n"));
+    console.log(`  ${pluginName}@${source.version} is committed at ${relTargetDir}/`);
+    console.log("  Push and redeploy to apply its migration and register its routes:");
+    console.log(chalk15.dim(`    git push`));
+    console.log(chalk15.dim(`    biffo deploy <environment> --app-only
+`));
+  } finally {
+    source.cleanup();
   }
-});
-
-// src/lib/sibling-session.ts
-import {
-  existsSync as existsSync22,
-  mkdirSync as mkdirSync9,
-  readdirSync as readdirSync10,
-  readFileSync as readFileSync18,
-  rmSync as rmSync8,
-  statSync as statSync5,
-  writeFileSync as writeFileSync7
-} from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join24 } from "path";
-function sessionsDir2() {
-  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join24(homedir3(), ".biffo", "sibling-sessions");
-}
-function sessionPath2(projectName) {
-  return join24(sessionsDir2(), `${projectName}.json`);
 }
-function findLatestSiblingSession() {
-  const dir = sessionsDir2();
-  if (!existsSync22(dir)) return null;
-  const files = readdirSync10(dir).filter((f) => f.endsWith(".json"));
-  if (files.length === 0) return null;
-  const sorted = files.map((f) => {
-    const fullPath = join24(dir, f);
-    const mtime = existsSync22(fullPath) ? statSync5(fullPath).mtimeMs : -1;
-    return { f, mtime };
-  }).sort((a, b) => b.mtime - a.mtime);
+function parseManifestFile(path) {
   try {
-    return JSON.parse(readFileSync18(join24(dir, sorted[0].f), "utf8"));
-  } catch {
-    return null;
+    return JSON.parse(readFileSync16(path, "utf8"));
+  } catch (err) {
+    throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
   }
 }
-function saveSiblingSession(session) {
-  const dir = sessionsDir2();
-  if (!existsSync22(dir)) mkdirSync9(dir, { recursive: true });
-  const name = session.config.project?.name ?? "unknown";
-  writeFileSync7(sessionPath2(name), JSON.stringify(session, null, 2));
-}
-function markSiblingStepComplete(session, step) {
-  if (!session.completedSteps.includes(step)) {
-    session.completedSteps.push(step);
+function printDryRun4(entry, source, relTargetDir, inTreeSource) {
+  const name = entry ? entry.name : source.name;
+  const version = entry ? entry.version : source.version;
+  console.log(chalk15.bold("\n  Dry run \u2014 no changes will be made\n"));
+  console.log(`  Plugin:        ${name}@${version}`);
+  if (entry) {
+    console.log(`  Source repo:   ${entry.repo}`);
+    console.log(`  Would clone into:   ${relTargetDir}/`);
+  } else {
+    console.log(`  Local source:  ${source.origin}`);
+    console.log(
+      inTreeSource ? `  Already in tree at ${relTargetDir}/ \u2014 would install in place (no copy)` : `  Would copy into:    ${relTargetDir}/`
+    );
   }
-  saveSiblingSession(session);
-}
-function deleteSiblingSession(projectName) {
-  const path = sessionPath2(projectName);
-  if (existsSync22(path)) rmSync8(path);
+  if (!entry || entry.infra_modules && entry.infra_modules.length > 0) {
+    console.log(
+      `  Would copy Terraform module into: modules/plugins/${name}/ (if the plugin has one)`
+    );
+    console.log(
+      `  Would wire module "plugin_${name}" + enabled_plugins into infra/environments/*/plugins.generated.tf and plugins.auto.tfvars.json`
+    );
+  }
+  if (source && source.manifest.tables.length > 0) {
+    console.log(
+      `  Would generate a migration for ${source.manifest.tables.length} table(s) into services/api/migrations/versions/`
+    );
+  }
+  console.log(`  Would commit:  feat(plugins): install ${name}@${version}
+`);
 }
 
-// src/commands/sibling-create.ts
-var siblingCreateCommand = new Command20("create").description(
-  "Create a standalone sibling app repository from the Biffo sibling template (ADR-0007)"
-).argument("<name>", "Sibling name; must match config.project.name").requiredOption("-c, --config <path>", "Path to a pre-filled biffo.sibling.json").option("--template <path>", "Path to sibling template (defaults to the bundled skeleton)").option("--dry-run", "Validate config and print planned changes without creating anything").option("--fresh", "Ignore any saved session and start from scratch").action(
-  async (name, options) => {
-    try {
-      assertBuildIsFresh();
-      await runSiblingCreateCommand(name, {
-        configPath: resolve16(options.config),
-        templateRoot: options.template ? resolve16(options.template) : defaultSiblingTemplateRoot(),
-        dryRun: options.dryRun === true,
-        fresh: options.fresh === true
-      });
-    } catch (err) {
-      log.error(err.message);
-      process.exit(1);
-    }
+// src/commands/plugin-list.ts
+import { existsSync as existsSync20, readFileSync as readFileSync17 } from "fs";
+import { join as join22, resolve as resolve13 } from "path";
+import chalk16 from "chalk";
+import { Command as Command16 } from "commander";
+var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
+  const cwd = options.cwd ? resolve13(options.cwd) : process.cwd();
+  try {
+    await runPluginList({ cwd });
+  } catch (err) {
+    log.error(err.message);
+    process.exit(1);
   }
-);
-async function runSiblingCreateCommand(name, options) {
-  console.log(chalk19.bold("\n  Biffo \u2014 Sibling App Creator\n"));
-  const config = readSiblingConfig(options.configPath);
-  if (config.project.name !== name) {
+});
+async function runPluginList(options) {
+  const servicesDir = join22(options.cwd, "services");
+  if (!existsSync20(servicesDir)) {
     throw new Error(
-      `Sibling name '${name}' does not match config project.name '${config.project.name}'.`
+      `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const coreConfig = resolveCoreConfig(config, options.configPath);
-  if (options.dryRun) {
-    printDryRun6(config, coreConfig, options.templateRoot);
-    return;
-  }
-  if (!existsSync23(options.templateRoot)) {
-    throw new Error(`Sibling template not found at ${options.templateRoot}`);
-  }
-  let session = null;
-  if (!options.fresh) {
-    const saved = findLatestSiblingSession();
-    if (saved && saved.config.project?.name === name) {
-      session = saved;
-      console.log(
-        chalk19.dim(
-          `  Resuming previous sibling create for ${name} (completed: ${saved.completedSteps.join(", ") || "none"})
-`
-        )
+  const plugins = [];
+  for (const location of findInstalledPlugins(options.cwd)) {
+    try {
+      const manifest = validateManifest(JSON.parse(readFileSync17(location.manifestPath, "utf8")));
+      plugins.push({
+        name: manifest.name,
+        version: manifest.version,
+        location: location.relDir
+      });
+    } catch (err) {
+      log.warn(
+        `Skipping ${location.relDir}/biffo.plugin.json \u2014 invalid manifest: ${err.message}`
       );
     }
   }
-  if (!session) {
-    session = {
-      version: 1,
-      config,
-      awsAccountId: config.cloud.config.account_id,
-      awsRegion: config.cloud.config.region,
-      completedSteps: [],
-      outputs: {}
-    };
-    saveSiblingSession(session);
+  if (plugins.length === 0) {
+    console.log(chalk16.dim("\n  No plugins installed in this checkout.\n"));
+    return;
   }
-  const token = await resolveGithubToken3(true);
-  const github = new GitHubAdapter(token);
-  const aws = new AwsAdapter(config);
-  const coreAws = new AwsAdapter(coreConfig);
-  const git = new GitAdapter();
-  await runSiblingCreate(github, aws, coreAws, git, config, session, {
-    coreConfig,
-    skeletonRoot: options.templateRoot,
-    githubToken: token
-  });
-  const { org, repo } = githubRepo(config);
-  const pathPrefix = config.core.path_prefix ?? config.project.name;
-  log.success("\nSibling repo created successfully!");
-  console.log(`
-  Repository: https://github.com/${org}/${repo}`);
-  console.log(`  Path:       /${pathPrefix}`);
-  if (session.outputs.registrationPrUrl) {
+  const nameWidth = Math.max(...plugins.map((p) => p.name.length), "NAME".length);
+  const versionWidth = Math.max(...plugins.map((p) => p.version.length), "VERSION".length);
+  console.log(chalk16.bold(`
+  Installed plugins (${plugins.length})
+`));
+  console.log(`  ${"NAME".padEnd(nameWidth)}  ${"VERSION".padEnd(versionWidth)}  LOCATION`);
+  for (const plugin of plugins) {
     console.log(
-      `  Registration PR (against ${coreConfig.project.name}): ${session.outputs.registrationPrUrl}`
+      `  ${plugin.name.padEnd(nameWidth)}  ${plugin.version.padEnd(versionWidth)}  ${plugin.location}`
     );
   }
   console.log(
-    `
-  Next steps:
-  1. Merge the registration PR above \u2014 until it merges, baseurl.com/${pathPrefix} won't route anywhere.
-  2. Add a SIBLING_GITHUB_TOKEN secret to this new repo (a PAT with repo scope) \u2014 needed by its
-     deploy workflow to export Terraform outputs as environment variables, same as the core project.
-  3. Push to \`dev\` (or run the Deploy workflow manually) to provision this sibling's own AWS resources.
-  4. Once the registration PR has ALSO merged and the core project has redeployed, set
-     PARENT_CLOUDFRONT_DISTRIBUTION_ARN on this repo and re-run its Deploy workflow \u2014 see this
-     repo's README, "The two-phase CDN registration".
+    chalk16.dim(
+      `
+  Note: no "status" / "last-updated" columns \u2014 the CLI tracks no installed-plugin registry locally. Once pushed and deployed, live status is available from the running Core API's GET /admin/plugins/available.
 `
+    )
   );
 }
-async function runSiblingCreate(github, aws, coreAws, git, config, session, options) {
-  const totalSteps = 7;
-  const { org, repo } = githubRepo(config);
-  const pathPrefix = config.core.path_prefix ?? config.project.name;
-  if (!session.completedSteps.includes("verify_credentials")) {
-    log.step(1, totalSteps, "Verifying AWS credentials...");
-    await aws.verifyCredentials();
-    markSiblingStepComplete(session, "verify_credentials");
-  } else {
-    log.step(1, totalSteps, "AWS credentials already verified \u2014 skipping");
-  }
-  if (!session.completedSteps.includes("resolve_core_identity")) {
-    log.step(2, totalSteps, "Resolving core project's identity...");
-    session.outputs.coreIdentity = await resolveCoreIdentity(
-      coreAws,
-      options.coreConfig,
-      config.environments
-    );
-    markSiblingStepComplete(session, "resolve_core_identity");
-  } else {
-    log.step(2, totalSteps, "Core identity already resolved \u2014 skipping");
-  }
-  const coreIdentity = session.outputs.coreIdentity;
-  if (!coreIdentity) {
-    throw new Error(
-      "internal error: resolve_core_identity did not populate session.outputs.coreIdentity"
-    );
-  }
-  if (!session.completedSteps.includes("create_repo")) {
-    log.step(3, totalSteps, "Creating GitHub repository and pushing sibling skeleton...");
-    const cloneUrl = await github.createEmptyRepo(
-      org,
-      repo,
-      config.project.description || void 0
-    );
-    session.outputs.cloneUrl = cloneUrl;
-    await pushSkeleton(
-      git,
-      options.skeletonRoot,
-      cloneUrl,
-      config,
-      options.coreConfig,
-      options.githubToken
-    );
-    markSiblingStepComplete(session, "create_repo");
-  } else {
-    log.step(3, totalSteps, "GitHub repository already created \u2014 skipping");
+
+// src/commands/plugin-sync-migrations.ts
+import { existsSync as existsSync21 } from "fs";
+import { join as join23, relative as relative4, resolve as resolve14 } from "path";
+import chalk17 from "chalk";
+import { Command as Command17 } from "commander";
+var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
+  "Generate real, committed migration file(s) for installed-but-not-yet-migrated plugin(s): biffo plugin sync-migrations [name]"
+).argument("[name]", "Restrict to this installed plugin (default: every plugin under services/)").option("--dry-run", "Generate nothing; just report what would be generated").option("--no-commit", "Generate and stage the file(s) but do not commit").option("--cwd <path>", "Project root (defaults to the current directory)").action(
+  async (name, options) => {
+    const cwd = options.cwd ? resolve14(options.cwd) : process.cwd();
+    try {
+      await runPluginSyncMigrations(
+        name,
+        { dryRun: options.dryRun ?? false, commit: options.commit, cwd },
+        { migrations: new PluginMigrationsAdapter(), git: new GitAdapter() }
+      );
+    } catch (err) {
+      log.error(err.message);
+      process.exit(1);
+    }
   }
-  if (!session.completedSteps.includes("oidc_trust")) {
-    log.step(4, totalSteps, "Configuring OIDC trust...");
-    session.outputs.oidcRoleArn = await aws.setupOidcTrust(
-      config,
-      await resolveRepoIds(github, config)
-    );
-    markSiblingStepComplete(session, "oidc_trust");
-  } else {
-    log.step(4, totalSteps, "OIDC trust already configured \u2014 skipping");
+);
+async function runPluginSyncMigrations(name, options, deps) {
+  const servicesDir = join23(options.cwd, "services");
+  if (!existsSync21(servicesDir)) {
+    throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (!session.completedSteps.includes("terraform_backend")) {
-    log.step(5, totalSteps, "Bootstrapping Terraform state backend...");
-    session.outputs.tfStateBucket = await aws.bootstrapTerraformBackend(config.project.name);
-    markSiblingStepComplete(session, "terraform_backend");
-  } else {
-    log.step(5, totalSteps, "Terraform backend already bootstrapped \u2014 skipping");
+  if (name && !existsSync21(join23(servicesDir, name, "biffo.plugin.json"))) {
+    throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
-  if (!session.completedSteps.includes("github_config")) {
-    log.step(6, totalSteps, "Configuring GitHub repository...");
-    await configureSiblingGithub(github, config, options.coreConfig, session, coreIdentity);
-    markSiblingStepComplete(session, "github_config");
-  } else {
-    log.step(6, totalSteps, "GitHub already configured \u2014 skipping");
+  if (options.dryRun) {
+    console.log(chalk17.bold("\n  Dry run \u2014 no changes will be made\n"));
+    console.log(`  Target: ${name ?? "all installed plugins under services/"}
+`);
+    return;
   }
-  if (!session.completedSteps.includes("register_with_core")) {
-    log.step(7, totalSteps, "Opening a registration PR against the core project...");
-    session.outputs.registrationPrUrl = await registerWithCore(
-      git,
-      github,
-      config,
-      options.coreConfig,
-      pathPrefix,
-      options.githubToken
+  const generated = await deps.migrations.generate(options.cwd, name ? [name] : void 0);
+  if (generated.length === 0) {
+    log.warn(
+      name ? `${name} already has a committed migration (or declares no tables) \u2014 nothing to do.` : "Every installed plugin already has a committed migration (or declares no tables) \u2014 nothing to do."
     );
-    markSiblingStepComplete(session, "register_with_core");
-  } else {
-    log.step(7, totalSteps, "Already registered with the core project \u2014 skipping");
+    return;
   }
-  deleteSiblingSession(config.project.name);
-}
-function readSiblingConfig(path) {
-  const raw = JSON.parse(readFileSync19(path, "utf8"));
-  const withDefaults = raw && typeof raw === "object" && "project" in raw && "core" in raw ? {
-    ...raw,
-    core: {
-      ...raw.core,
-      path_prefix: raw.core.path_prefix ?? raw.project.name
+  const relativePaths = generated.map((p) => relative4(options.cwd, p));
+  for (const p of relativePaths) {
+    log.success(`Generated ${p}`);
+  }
+  if (options.commit) {
+    const isRepo = await deps.git.isGitRepo(options.cwd);
+    if (!isRepo) {
+      throw new Error(`${options.cwd} is not a git repository \u2014 cannot commit.`);
     }
-  } : raw;
-  const result = SiblingConfigSchema.safeParse(withDefaults);
-  if (!result.success) {
-    throw new Error(
-      "Invalid sibling configuration:\n" + result.error.issues.map((issue) => `  ${issue.path.join(".")} \u2014 ${issue.message}`).join("\n")
-    );
+    await deps.git.add(options.cwd, relativePaths);
+    const label = name ?? `${String(generated.length)} plugin(s)`;
+    const commitMessage = `chore(plugins): sync migration(s) for ${label}`;
+    await deps.git.commit(options.cwd, commitMessage);
+    log.success(`Committed: ${commitMessage}`);
+  } else {
+    log.warn("--no-commit: generated file(s) are on disk but not staged/committed.");
   }
-  return result.data;
 }
-function resolveCoreConfig(config, configPath) {
-  if (config.core.config_path) {
-    const corePath = resolve16(dirname8(configPath), config.core.config_path);
-    return parseCoreConfig(corePath);
+
+// src/commands/plugin-uninstall.ts
+import { existsSync as existsSync22, readFileSync as readFileSync18, rmSync as rmSync7 } from "fs";
+import { join as join24, resolve as resolve15 } from "path";
+import chalk18 from "chalk";
+import { Command as Command18 } from "commander";
+import inquirer6 from "inquirer";
+var NAME_PATTERN2 = /^[a-z][a-z0-9-]*$/;
+var pluginUninstallCommand = new Command18("uninstall").description("Remove an installed plugin: biffo plugin uninstall <name>").argument("<name>", "Plugin name").option("--dry-run", "Print planned changes without modifying the repo").option("--force", "Skip the confirmation prompt").option(
+  "--keep-data",
+  "No-op today (see notes) \u2014 the CLI never drops plugin data regardless of this flag"
+).option("--cwd <path>", "Project root to uninstall from (defaults to the current directory)").action(
+  async (name, options) => {
+    const cwd = options.cwd ? resolve15(options.cwd) : process.cwd();
+    try {
+      await runPluginUninstall(
+        name,
+        {
+          dryRun: options.dryRun ?? false,
+          force: options.force ?? false,
+          keepData: options.keepData ?? false,
+          cwd
+        },
+        { git: new GitAdapter() }
+      );
+    } catch (err) {
+      log.error(err.message);
+      process.exit(1);
+    }
   }
-  if (config.core.project_name) {
-    const saved = loadProjectConfig(config.core.project_name);
-    if (saved) return saved;
-    throw new Error(
-      `Core project '${config.core.project_name}' was not found in ~/.biffo/projects. Set core.config_path to the core project biffo.config.json instead.`
-    );
+);
+async function runPluginUninstall(name, options, deps) {
+  if (!NAME_PATTERN2.test(name)) {
+    throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  throw new Error("Either core.project_name or core.config_path is required.");
-}
-function parseCoreConfig(path) {
-  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync19(path, "utf8")));
-  if (!result.success) {
+  const servicesDir = join24(options.cwd, "services");
+  if (!existsSync22(servicesDir)) {
     throw new Error(
-      `Invalid core configuration at ${path}:
-` + result.error.issues.map((issue) => `  ${issue.path.join(".")} \u2014 ${issue.message}`).join("\n")
+      `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  return result.data;
-}
-async function resolveCoreIdentity(coreAws, coreConfig, environments) {
-  const coreAwsConfig = coreConfig.cloud.config;
-  const stateBucket = coreAwsConfig.tf_state_bucket ?? `${coreConfig.project.name}-terraform-state-${coreAwsConfig.account_id}`;
-  const coreIdentity = {};
-  for (const env of environments) {
-    const stateKey = `${env}/terraform.tfstate`;
-    log.info(`Reading ${coreConfig.project.name}'s Terraform outputs for ${env}...`);
-    const outputs = await coreAws.readTerraformOutputs(stateBucket, stateKey);
-    for (const key of [
-      "cognito_user_pool_id",
-      "cognito_client_id",
-      "api_gateway_url",
-      "portal_url"
-    ]) {
-      if (!outputs[key]) {
-        throw new Error(
-          `${key} not found in ${coreConfig.project.name}'s Terraform outputs for ${env}. Has the core project been deployed to ${env}? Run \`biffo deploy ${env}\` from the core project first.`
-        );
-      }
+  const targetDir = join24(servicesDir, name);
+  if (!existsSync22(targetDir)) {
+    const firstParty = join24(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync22(firstParty)) {
+      throw new Error(
+        `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
+      );
     }
-    coreIdentity[env] = {
-      cognitoUserPoolId: outputs["cognito_user_pool_id"],
-      cognitoClientId: outputs["cognito_client_id"],
-      apiUrl: outputs["api_gateway_url"],
-      portalUrl: outputs["portal_url"]
-    };
-  }
-  return coreIdentity;
-}
-async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, githubToken) {
-  const workDir = mkdtempSync4(join25(tmpdir4(), `biffo-sibling-${config.project.name}-`));
-  try {
-    writeSiblingTemplate(skeletonRoot, workDir, config, {
-      coreProjectName: coreConfig.project.name,
-      pathPrefix: config.core.path_prefix ?? config.project.name
-    });
-    await git.init(workDir, "main");
-    await git.addRemote(workDir, "origin", cloneUrl);
-    await git.add(workDir, ["."]);
-    await git.commit(workDir, `feat: scaffold ${config.project.name} sibling app (ADR-0007)`);
-    await git.push(workDir, "main", { token: githubToken });
-  } finally {
-    git.cleanup(workDir);
+    throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
-}
-function writeSiblingTemplate(templateRoot, targetDir, config, context) {
-  if (!existsSync23(templateRoot)) {
-    throw new Error(`Sibling template not found at ${templateRoot}`);
+  const version = readInstalledVersion(targetDir);
+  const modulesDir = join24(options.cwd, "modules", "plugins", name);
+  const stagePaths = [`services/${name}`];
+  if (existsSync22(modulesDir)) {
+    stagePaths.push(`modules/plugins/${name}`);
   }
-  cpSync4(templateRoot, targetDir, { recursive: true });
-  writeFileSync8(
-    join25(targetDir, "biffo.sibling.json"),
-    JSON.stringify(
-      {
-        name: config.project.name,
-        core_project: context.coreProjectName,
-        path_prefix: context.pathPrefix,
-        ...config.project.description ? { description: config.project.description } : {},
-        // Always written (even when empty) so the field is discoverable — declare
-        // this sibling's notable routes here and they surface on the core's
-        // Microservices tab. See SiblingConfigSchema.project.routes.
-        routes: config.project.routes
-      },
-      null,
-      2
-    ) + "\n"
-  );
-  const envPath = join25(targetDir, "apps", "frontend", ".env.example");
-  try {
-    const path = `/${context.pathPrefix}`;
-    const content = readFileSync19(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
-    writeFileSync8(envPath, content);
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
+  if (options.dryRun) {
+    printDryRun5(name, version, stagePaths, options.keepData);
+    return;
   }
-}
-async function configureSiblingGithub(github, config, coreConfig, session, coreIdentity) {
-  const { org, repo } = githubRepo(config);
-  await github.createBranch(org, repo, "dev", "main");
-  await github.createBranch(org, repo, "staging", "main");
-  await github.setDefaultBranch(org, repo, "dev");
-  await github.configureBranchProtection(config);
-  await github.createEnvironments(config);
-  await github.enableVulnerabilityAlerts(org, repo);
-  await github.setRepoVariable(org, repo, "PROJECT_NAME", config.project.name);
-  await github.setRepoVariable(
-    org,
-    repo,
-    "PATH_PREFIX",
-    config.core.path_prefix ?? config.project.name
-  );
-  await github.setRepoVariable(org, repo, "AWS_REGION", awsConfig(config).region);
-  await github.setRepoVariable(org, repo, "SIBLING_DEPLOY_ENABLED", "true");
-  try {
-    const { org: coreOrg, repo: coreRepo } = coreConfig.source_control.config;
-    const runnerLabel = await github.getRepoVariable(coreOrg, coreRepo, "RUNNER_LABEL");
-    if (runnerLabel && runnerLabel.trim()) {
-      await github.setRepoVariable(org, repo, "RUNNER_LABEL", runnerLabel);
+  if (!options.force) {
+    const proceed = await confirmUninstall(name, version);
+    if (!proceed) {
+      log.warn("Uninstall cancelled");
+      return;
     }
-  } catch (err) {
-    log.warn(
-      `Could not propagate RUNNER_LABEL from the core project to ${org}/${repo}: ${err.message}. The sibling will default to ubuntu-latest runners.`
+  }
+  const isRepo = await deps.git.isGitRepo(options.cwd);
+  if (!isRepo) {
+    throw new Error(
+      `${options.cwd} is not a git repository \u2014 biffo plugin uninstall must be run from a Biffo project checkout.`
     );
   }
-  if (session.outputs.tfStateBucket) {
-    await github.setRepoVariable(org, repo, "TF_STATE_BUCKET", session.outputs.tfStateBucket);
+  rmSync7(targetDir, { recursive: true, force: true });
+  log.success(`Removed services/${name}/`);
+  if (existsSync22(modulesDir)) {
+    rmSync7(modulesDir, { recursive: true, force: true });
+    log.success(`Removed modules/plugins/${name}/`);
+    const wiring = syncPluginTerraform(options.cwd);
+    stagePaths.push(...wiring.changedPaths);
+    if (wiring.changedPaths.length > 0) {
+      log.success(
+        `Unwired module "plugin_${name}" and its enabled_plugins entry from ${wiring.environments.length} environment(s): ${wiring.environments.join(", ")}`
+      );
+    }
   }
-  for (const env of config.environments) {
-    const identity = coreIdentity[env];
-    if (!identity) continue;
-    await github.setEnvVariable(
-      org,
-      repo,
-      env,
-      "CORE_COGNITO_USER_POOL_ID",
-      identity.cognitoUserPoolId
+  const label = version ? `${name}@${version}` : name;
+  const commitMessage = `chore(plugins): uninstall ${label}`;
+  await deps.git.add(options.cwd, stagePaths);
+  await deps.git.commit(options.cwd, commitMessage);
+  log.success(`Committed: ${commitMessage}`);
+  console.log(chalk18.bold("\n  Plugin uninstalled!\n"));
+  console.log(`  services/${name}/ has been removed and committed.`);
+  console.log(
+    "  Push and redeploy so the Core API stops discovering its routes at the next db-init:"
+  );
+  console.log(chalk18.dim(`    git push`));
+  console.log(chalk18.dim(`    biffo deploy <environment> --app-only
+`));
+  if (options.keepData) {
+    console.log(
+      chalk18.dim(
+        "  --keep-data: no action was needed \u2014 the CLI never drops plugin tables. See notes.\n"
+      )
     );
-    await github.setEnvVariable(org, repo, env, "CORE_COGNITO_CLIENT_ID", identity.cognitoClientId);
-    await github.setEnvVariable(org, repo, env, "CORE_API_URL", identity.apiUrl);
-    await github.setEnvVariable(org, repo, env, "CORE_PORTAL_URL", identity.portalUrl);
-    await github.setEnvVariable(
-      org,
-      repo,
-      env,
-      "CORS_ORIGINS_JSON",
-      JSON.stringify([identity.portalUrl])
+  } else {
+    log.warn(
+      "Any tables this plugin created remain in the database, and its migration file at services/api/migrations/versions/ is NOT removed (it is a permanent historical record \u2014 see notes). Dropping tables, if desired, requires a manual Alembic migration written against the Core API."
     );
   }
-  if (session.outputs.oidcRoleArn) {
-    await github.setRepoSecret(org, repo, "SIBLING_OIDC_ROLE_ARN", session.outputs.oidcRoleArn);
+}
+function readInstalledVersion(targetDir) {
+  const manifestPath = join24(targetDir, "biffo.plugin.json");
+  if (!existsSync22(manifestPath)) return void 0;
+  try {
+    return validateManifest(JSON.parse(readFileSync18(manifestPath, "utf8"))).version;
+  } catch {
+    return void 0;
   }
 }
-function bucketRegionalDomain(bucketName, region) {
-  return region === "us-east-1" ? `${bucketName}.s3.amazonaws.com` : `${bucketName}.s3.${region}.amazonaws.com`;
+async function confirmUninstall(name, version) {
+  const label = version ? `${name}@${version}` : name;
+  const { confirmed } = await inquirer6.prompt([
+    {
+      type: "confirm",
+      name: "confirmed",
+      message: `Remove ${chalk18.bold(label)} from services/${name}/? This cannot be undone from the CLI.`,
+      default: false
+    }
+  ]);
+  return confirmed;
 }
-function siteBucketName(projectName, environment, accountId) {
-  return `${projectName}-${environment}-site-${accountId}`;
+function printDryRun5(name, version, stagePaths, keepData) {
+  const label = version ? `${name}@${version}` : name;
+  console.log(chalk18.bold("\n  Dry run \u2014 no changes will be made\n"));
+  console.log(`  Plugin:        ${label}`);
+  console.log(`  Would remove:  ${stagePaths.join(", ")}`);
+  console.log(
+    `  Would unwire:  module "plugin_${name}" + its enabled_plugins entry from infra/environments/*/plugins.generated.tf`
+  );
+  console.log(`  Would commit:  chore(plugins): uninstall ${label}`);
+  console.log(
+    `  --keep-data:   ${keepData ? "no-op \u2014 CLI never drops tables either way" : "not set \u2014 no DB action taken either way; see notes"}
+`
+  );
 }
-function readExistingSiblingOrigins(filePath) {
+
+// src/commands/plugin-upgrade.ts
+import { cpSync as cpSync4, existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync19, rmSync as rmSync8 } from "fs";
+import { join as join25, relative as relative5, resolve as resolve16 } from "path";
+import chalk19 from "chalk";
+import { Command as Command19 } from "commander";
+import inquirer7 from "inquirer";
+var pluginUpgradeCommand = new Command19("upgrade").description(
+  "Upgrade an installed plugin to a new minor version: biffo plugin upgrade <name>@<new-minor>"
+).argument("<target>", "Plugin name and new minor version, e.g. rbac@1.1").option("--dry-run", "Resolve the new version and print planned changes without applying them").option("--force", "Skip the confirmation prompt").option("--cwd <path>", "Project root to upgrade in (defaults to the current directory)").action(async (target, options) => {
+  const cwd = options.cwd ? resolve16(options.cwd) : process.cwd();
   try {
-    return JSON.parse(readFileSync19(filePath, "utf8"));
+    await runPluginUpgrade(
+      target,
+      { dryRun: options.dryRun ?? false, force: options.force ?? false, cwd },
+      {
+        registry: new RegistryAdapter(),
+        git: new GitAdapter(),
+        migrations: new PluginMigrationsAdapter()
+      }
+    );
   } catch (err) {
-    if (err.code === "ENOENT") return {};
-    throw err;
+    log.error(err.message);
+    process.exit(1);
   }
-}
-function assertCoreSupportsSiblingRouting(cloneDir, coreRepo) {
-  const cdnVarsPath = join25(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
-  let declaresSiblingOrigins = false;
-  try {
-    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync19(cdnVarsPath, "utf8"));
-  } catch {
-    declaresSiblingOrigins = false;
+});
+async function runPluginUpgrade(target, options, deps) {
+  const { name, minor } = parsePluginTarget(target);
+  const servicesDir = join25(options.cwd, "services");
+  if (!existsSync23(servicesDir)) {
+    throw new Error(
+      `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
+    );
   }
-  if (!declaresSiblingOrigins) {
+  const targetDir = join25(servicesDir, name);
+  if (!existsSync23(targetDir)) {
     throw new Error(
-      `The core project "${coreRepo}" doesn't support sibling CDN routing yet (its modules/cloud/aws/cdn predates ADR-0007). Run \`biffo core upgrade\` against it first, then re-run \`biffo sibling create\`.`
+      `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
   }
-}
-async function registerWithCore(git, github, config, coreConfig, pathPrefix, githubToken) {
-  const { org: coreOrg, repo: coreRepo } = coreConfig.source_control.config;
-  const coreCloneUrl = `https://github.com/${coreOrg}/${coreRepo}.git`;
-  const coreAwsRegion = awsConfig(coreConfig).region;
-  const siblingAccountId = config.cloud.config.account_id;
-  const cloneDir = await git.cloneForEditing(
-    coreCloneUrl,
-    `biffo-sibling-register-${config.project.name}`,
-    githubToken
-  );
-  try {
-    assertCoreSupportsSiblingRouting(cloneDir, coreRepo);
-    const base = await git.currentBranch(cloneDir);
-    const branch = `biffo/register-sibling-${config.project.name}`.replace(/[^a-zA-Z0-9._/-]/g, "-");
-    await git.createBranch(cloneDir, branch);
-    const touchedFiles = [];
-    for (const env of config.environments) {
-      const bucketName = siteBucketName(config.project.name, env, siblingAccountId);
-      const domain = bucketRegionalDomain(bucketName, coreAwsRegion);
-      const relativePath = join25("infra", "environments", env, "siblings.auto.tfvars.json");
-      const filePath = join25(cloneDir, relativePath);
-      const existing = readExistingSiblingOrigins(filePath);
-      const siblings = (existing.sibling_origins ?? []).filter((s) => s.name !== pathPrefix);
-      siblings.push({
-        name: pathPrefix,
-        bucket_regional_domain: domain,
-        ...config.project.description ? { description: config.project.description } : {},
-        ...config.project.routes.length > 0 ? { routes: config.project.routes } : {}
-      });
-      mkdirSync10(dirname8(filePath), { recursive: true });
-      writeFileSync8(filePath, JSON.stringify({ sibling_origins: siblings }, null, 2) + "\n");
-      touchedFiles.push(relativePath);
+  const currentVersion = readInstalledVersion2(targetDir);
+  log.info(`Resolving ${name}@${minor} from the plugin registry...`);
+  const entry = await deps.registry.resolvePlugin(name, minor);
+  log.success(`Resolved ${entry.name}@${entry.version} \u2014 ${entry.repo}`);
+  if (entry.required_core_version) {
+    log.warn(
+      `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
+    );
+  }
+  const modulesDir = join25(options.cwd, "modules", "plugins", entry.name);
+  if (options.dryRun) {
+    printDryRun6(entry, currentVersion);
+    return;
+  }
+  if (currentVersion === entry.version) {
+    log.warn(`services/${name}/ is already at ${entry.version} \u2014 nothing to upgrade.`);
+    return;
+  }
+  if (!options.force) {
+    const proceed = await confirmUpgrade(name, currentVersion, entry.version);
+    if (!proceed) {
+      log.warn("Upgrade cancelled");
+      return;
     }
-    await git.add(cloneDir, touchedFiles);
-    await git.commit(
-      cloneDir,
-      `infra(cdn): register sibling "${pathPrefix}" for path-based routing (ADR-0007)`
+  }
+  const isRepo = await deps.git.isGitRepo(options.cwd);
+  if (!isRepo) {
+    throw new Error(
+      `${options.cwd} is not a git repository \u2014 biffo plugin upgrade must be run from a Biffo project checkout.`
     );
-    await git.push(cloneDir, branch, { token: githubToken });
-    const remoteUrl = await git.getRemoteUrl(cloneDir);
-    const { owner, repo } = parseGitHubRepo(remoteUrl);
-    const pr = await github.createPullRequest({
-      owner,
-      repo,
-      head: branch,
-      base,
-      title: `Register sibling "${pathPrefix}" for CDN routing (ADR-0007)`,
-      body: buildRegistrationPrBody(config, pathPrefix, touchedFiles)
-    });
-    return pr.url;
+  }
+  log.info(`Cloning ${entry.repo}...`);
+  const { tmpDir, manifest } = await cloneAndValidatePlugin(entry, deps.git);
+  try {
+    log.success(
+      `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
+    );
+    rmSync8(targetDir, { recursive: true, force: true });
+    mkdirSync10(targetDir, { recursive: true });
+    cpSync4(tmpDir, targetDir, { recursive: true });
+    log.success(`Upgraded plugin source at services/${entry.name}/`);
+    const stagePaths = [`services/${entry.name}`];
+    if (existsSync23(modulesDir)) {
+      rmSync8(modulesDir, { recursive: true, force: true });
+    }
+    const tfSourceDir = join25(targetDir, "terraform");
+    if (existsSync23(tfSourceDir)) {
+      mkdirSync10(modulesDir, { recursive: true });
+      cpSync4(tfSourceDir, modulesDir, { recursive: true });
+      stagePaths.push(`modules/plugins/${entry.name}`);
+      log.success(`Copied Terraform module to modules/plugins/${entry.name}/`);
+    }
+    if (manifest.tables.length > 0) {
+      log.info(
+        `Generating migration for services/${entry.name}/'s ${manifest.tables.length} table(s)...`
+      );
+      const generatedPaths = await deps.migrations.generate(options.cwd, [entry.name]);
+      for (const absPath of generatedPaths) {
+        stagePaths.push(relative5(options.cwd, absPath));
+      }
+      if (generatedPaths.length > 0) {
+        log.success(`Generated migration: ${relative5(options.cwd, generatedPaths[0])}`);
+      }
+    }
+    const label = currentVersion ? `${entry.name} ${currentVersion} -> ${entry.version}` : `${entry.name} to ${entry.version}`;
+    const commitMessage = `feat(plugins): upgrade ${label}`;
+    await deps.git.add(options.cwd, stagePaths);
+    await deps.git.commit(options.cwd, commitMessage);
+    log.success(`Committed: ${commitMessage}`);
+    console.log(chalk19.bold("\n  Plugin upgraded!\n"));
+    console.log(`  ${entry.name}@${entry.version} is committed at services/${entry.name}/`);
+    console.log("  Push and redeploy to apply its updated tables and routes:");
+    console.log(chalk19.dim(`    git push`));
+    console.log(chalk19.dim(`    biffo deploy <environment> --app-only
+`));
   } finally {
-    git.cleanup(cloneDir);
+    deps.git.cleanup(tmpDir);
   }
 }
-function buildRegistrationPrBody(config, pathPrefix, touchedFiles) {
-  const { org, repo } = githubRepo(config);
-  return [
-    "Automated sibling registration generated by `biffo sibling create` (ADR-0007).",
-    "",
-    `Adds **${org}/${repo}** to this project's CloudFront distribution as a new path-routed origin \u2014 once merged and redeployed, \`baseurl.com/${pathPrefix}/*\` routes to that sibling's own S3 bucket.`,
-    "",
-    `## Files changed (${touchedFiles.length})`,
-    "",
-    ...touchedFiles.map((f) => `- \`${f}\``),
-    "",
-    "## After merging",
-    "",
-    "This sibling's own S3 bucket policy still needs this distribution's real ARN (a two-phase handshake \u2014 see the sibling repo's README, \"The two-phase CDN registration\"). Once this PR merges and this project redeploys, set `PARENT_CLOUDFRONT_DISTRIBUTION_ARN` on the sibling repo and re-run its deploy workflow."
-  ].join("\n");
-}
-function printDryRun6(config, coreConfig, templateRoot) {
-  const { org, repo } = githubRepo(config);
-  const pathPrefix = config.core.path_prefix ?? config.project.name;
-  console.log(chalk19.bold("\n  Dry run \u2014 no changes will be made\n"));
-  console.log(`  Sibling:       ${config.project.name}`);
-  console.log(`  Repository:    ${org}/${repo}`);
-  console.log(`  Core project:  ${coreConfig.project.name}`);
-  console.log(`  Path prefix:   /${pathPrefix}`);
-  console.log(`  Environments:  ${config.environments.join(", ")}`);
-  console.log(`  Template:      ${templateRoot}`);
-  console.log("\n  Would:");
-  console.log("    - resolve the core project's Cognito/API identity for each environment");
-  console.log("    - create an empty private sibling GitHub repository");
-  console.log("    - copy and rewrite _skeletons/sibling-template into the repo");
-  console.log("    - push main, create dev/staging, and set dev as default");
-  console.log("    - create AWS OIDC trust and a Terraform state bucket");
-  console.log("    - configure repository secrets, variables, environments, and branch protection");
-  console.log("    - open a PR against the core project to register this sibling for CDN routing\n");
-}
-function githubRepo(config) {
-  return config.source_control.config;
+function readInstalledVersion2(targetDir) {
+  const manifestPath = join25(targetDir, "biffo.plugin.json");
+  if (!existsSync23(manifestPath)) return void 0;
+  try {
+    return validateManifest(JSON.parse(readFileSync19(manifestPath, "utf8"))).version;
+  } catch {
+    return void 0;
+  }
 }
-function awsConfig(config) {
-  return config.cloud.config;
+async function confirmUpgrade(name, currentVersion, newVersion) {
+  const message = currentVersion ? `Upgrade ${chalk19.bold(name)} from ${currentVersion} to ${chalk19.bold(newVersion)}?` : `Upgrade ${chalk19.bold(name)} to ${chalk19.bold(newVersion)}?`;
+  const { confirmed } = await inquirer7.prompt([
+    { type: "confirm", name: "confirmed", message, default: false }
+  ]);
+  return confirmed;
 }
-function defaultSiblingTemplateRoot() {
-  let dir = dirname8(new URL(import.meta.url).pathname);
-  for (; ; ) {
-    const candidate = join25(dir, "_skeletons", "sibling-template");
-    if (existsSync23(candidate)) return candidate;
-    const parent = dirname8(dir);
-    if (parent === dir) break;
-    dir = parent;
+function printDryRun6(entry, currentVersion) {
+  console.log(chalk19.bold("\n  Dry run \u2014 no changes will be made\n"));
+  console.log(`  Plugin:        ${entry.name}`);
+  console.log(`  Current:       ${currentVersion ?? "(unknown \u2014 manifest unreadable)"}`);
+  console.log(`  Would upgrade to: ${entry.version}`);
+  console.log(`  Source repo:   ${entry.repo}`);
+  console.log(`  Would replace: services/${entry.name}/`);
+  if (entry.infra_modules && entry.infra_modules.length > 0) {
+    console.log(
+      `  Would replace Terraform module at: modules/plugins/${entry.name}/ (if the repo has one)`
+    );
   }
-  return resolve16(process.cwd(), "_skeletons", "sibling-template");
+  console.log(`  Would commit:  feat(plugins): upgrade ${entry.name} to ${entry.version}
+`);
 }
 
+// src/commands/plugin.ts
+var pluginCommand = new Command20("plugin").description("Manage Biffo plugins");
+pluginCommand.addCommand(pluginCreateCommand);
+pluginCommand.addCommand(pluginListCommand);
+pluginCommand.addCommand(pluginInstallCommand);
+pluginCommand.addCommand(pluginUninstallCommand);
+pluginCommand.addCommand(pluginUpgradeCommand);
+pluginCommand.addCommand(pluginSyncMigrationsCommand);
+pluginCommand.addCommand(pluginInfoCommand);
+
 // src/commands/sibling.ts
+import { Command as Command21 } from "commander";
 var siblingCommand = new Command21("sibling").description(
   "Create and manage sibling apps that share a Biffo core project (ADR-0007)"
 );
@@ -5946,7 +6132,9 @@ var SIBLING_MARKER_FILE = "biffo.sibling.json";
 function markerMatches(marker, coreProjectName, sibling) {
   if (!marker) return false;
   if (marker.core_project !== coreProjectName) return false;
-  return marker.path_prefix === sibling.pathPrefix || marker.name === sibling.projectName;
+  if (marker.path_prefix === sibling.pathPrefix) return true;
+  if (marker.path_prefix === "" && sibling.pathPrefix === ROOT_SIBLING_NAME) return true;
+  return marker.name === sibling.projectName;
 }
 async function resolveSiblingRepos(github, coreOrg, coreProjectName, siblings) {
   const resolved = [];
@@ -6338,7 +6526,7 @@ function formatSiblingPlan(siblings, skipDestroy) {
       continue;
     }
     lines.push(
-      `    ${chalk20.red("\u2717")} GitHub repository  ${chalk20.bold(`${s.org}/${s.repo}`)} (routed at /${s.pathPrefix})`
+      `    ${chalk20.red("\u2717")} GitHub repository  ${chalk20.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
     );
     lines.push(
       `      ${chalk20.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`